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Introduction 


Why should you learn about Linux? It's a fast-growing operating system, and it 
is inexpensive and flexible. Linux is also a major player in the small and mid- 
size server field, and it's an increasingly viable platform for workstation and 
desktop use as well. By understanding Linux, you'll increase your standing in the 
job market. Even if you already know Windows or Mac OS and your employer 
uses these systems exclusively, understanding Linux will give you an edge when 
you're looking for a new job or you're looking for a promotion. For instance, this 
knowledge will help you make an informed decision about if and when you 
should deploy Linux. 


The Computing Technology Industry Association (CompTIA) has developed its 
Linux+ certification as an introductory certification for people who want to enter 
careers involving Linux. The exam is meant to certify that an individual has the 
skills necessary to install, operate, and troubleshoot a Linux system and is 
familiar with Linux-specific concepts and basic hardware. 


The purpose of this book is to help you pass the Linux+ exams (LX0-103 and 
LX0-104), updated in 2015. Because these exams cover basic Linux installation, 
configuration, maintenance, applications, networking, and security, those are the 
topics that are emphasized in this book. You'll learn enough to get a Linux 
system up and running and to configure it for many common tasks. Even after 
you've taken and passed the Linux+ exams, this book should remain a useful 
reference. 


What Is Linux? 


Linux is a clone of the Unix operating system (OS) that has been popular in 
academia and many business environments for years. Formerly used exclusively 
on large mainframes, Unix and Linux can now run on small computers, which 
are actually far more powerful than the mainframes of just a few years ago. 
Because of its mainframe heritage, Unix (and hence also Linux) scales well to 
perform today's demanding scientific, engineering, and network server tasks. 


Linux consists of a kernel, which is the core control software, and many libraries 
and utilities that rely on the kernel to provide features with which users interact. 
The OS is available in many different distributions, which are collections of a 
specific kernel with specific support programs. 


Why Become Linux Certified? 


Several good reasons to get your Linux certification exist. There are four major 
benefits: 


Relevance 


The exams were designed with the needs of Linux professionals in mind. 
Surveys of Linux administrators were performed to learn what they actually 
needed to know to do their jobs. 

Quality 


The exams have been extensively tested and validated using psychometric 
standards. The result is an ability to discriminate between competent 
administrators and those who must still learn more material. 


Neutrality 


CompTIA is an organization that doesn't itself market any Linux 
distribution. This fact removes the motivation to create an exam that's 
designed as a way to market a particular distribution. 

Support 


Major players in the Linux world support the exams. 


How to Become Certified 


The certification is available to anyone who passes the two required exams: 
LX0-103 and LX0-104 (often referred to as simply 103 and 104). You don't have 
to work for a particular company. It's not a secret society. 


Pearson VUE administers the exam. The exam can be taken at any Pearson VUE 
testing center. If you pass, you will get a certificate in the mail saying that you 
have passed. 
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To register for the exam with Pearson VUE, call (877) 619-2096 or register 
online at www.vue.com. However you do it, you'll be asked for your name, 
mailing address, phone number, employer, when and where you want to take 
the test (that is, which testing center), and your credit card number 
(arrangement for payment must be made at the time of registration). 


Who Should Buy This Book 


Anybody who wants to pass the certification exams may benefit from this book. 
This book covers the material that someone new to Linux will need to learn the 
OS from the beginning, and it continues to provide the knowledge you need up 
to a proficiency level sufficient to pass the two exams. You can pick up this 
book and learn from it even if you've never used Linux before, although you'll 
find it an easier read if you've at least casually used Linux for a few days. If 
you're already familiar with Linux, this book can serve as a review and as a 
refresher course for information with which you might not be completely 
familiar. In either case, reading this book will help you pass the exams. 


This book is written with the assumption that you know at least a little bit about 
Linux (what it is and possibly a few Linux commands). We also assume that you 
know some basics about computers in general, such as how to use a keyboard, 
how to insert a disc into an optical drive, and so on. Chances are that you have 
used computers in a substantial way in the past—perhaps even Linux, as an 
ordinary user, or maybe you have used Windows or Mac OS. We do not assume 
that you have extensive knowledge of Linux system administration, but if you've 
done some system administration, you can still use this book to fill in gaps in 
your knowledge. 
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As a practical matter, you'll need a Linux system with which to practice and 
learn in a hands-on way. Neither the exams nor this book covers actually 
installing Linux on a computer from scratch, although some of the 
prerequisites (such as disk partitioning) are covered. You may need to refer 
to your distribution's documentation to learn how to accomplish this task. 
Alternatively, several vendors sell computers with Linux preinstalled. 


How This Book Is Organized 


This book consists of 10 chapters plus supplementary information: an online 
glossary, this introduction, and the assessment test after the introduction. The 
chapters are organized as follows: 


e Chapter 1, “Exploring Linux Command-Line Tools,” covers the basic tools 
that you need to interact with Linux. These include shells, redirection, 
pipes, text filters, and regular expressions. 


e Chapter 2, “Managing Software,” describes the programs that you'll use to 
manage software. Much of this task is centered around the RPM and 
Debian package management systems. The chapter also covers handling 
shared libraries and managing processes (that is, running programs). 


e Chapter 3, “Configuring Hardware,” focuses on Linux's interactions with 
the hardware on which it runs. Specific hardware and procedures for using 
it include the BIOS, expansion cards, USB devices, hard disks, and the 
partitions and filesystems used on hard disks. 


e Chapter 4, “Managing Files,” covers the tools used to manage files. This 
includes commands to manage files, ownership, and permissions as well as 
Linux's standard directory tree and tools for archiving files. 


e Chapter 5, “Booting Linux and Editing Files,” explains how Linux boots up 
and how you can edit files in Linux. Specific topics include the GRUB 
Legacy and GRUB 2 boot loaders, boot diagnostics, runlevels, and the vi 
editor. 


e Chapter 6, “Configuring the X Window System, Localization, and 
Printing,” describes the Linux GUI and printing subsystems. Topics include 
X configuration, managing GUI logins, configuring location-specific 
features, enabling accessibility features, and setting up Linux to use a 
printer. 


e Chapter 7, “Administering the System,” describes miscellaneous 
administrative tasks. These include user and group management, tuning 
user environments, managing log files, setting the clock, and running jobs 
in the future. 


e Chapter 8, “Configuring Basic Networking,” focuses on basic network 
configuration. Topics include TCP/IP basics, setting up Linux on a TCP/IP 
network, and network diagnostics. 


e Chapter 9, “Writing Scripts, Configuring Email, and Using Databases,” 
covers these miscellaneous topics. Scripts are small programs that 
administrators often use to help automate common tasks. Email, of course, 
is an important topic for any computer user, particularly on Linux, which 
often runs an email server for local or remote use. Linux can run databases 
that help you store and retrieve information, and these tools can be very 
important ones on many Linux systems. 


e Chapter 10, “Securing Your System,” covers security. Specific subjects 
include network security, local security, and the use of encryption to 
improve security. 


Chapters 1 through 5 cover the LX0-103 exam, while Chapters 6 through 10 
cover the LX0-104 exam. These make up Part I and Part II of the book, 
respectively. 





What's Included in the Book 
We've included several study learning tools throughout the book: 
Assessment Test 


At the end of this introduction is an assessment test that you can use to 
check your readiness for the exam. Take this test before you start reading 
the book; it will help you determine the areas you might need to brush up 
on. The answers to the assessment test questions appear on a separate page 
after the last question of the test. Each answer includes an explanation and a 
note telling you the chapter in which the material appears. 


Objective Map and Opening List of Objectives 


An objective map shows you where each of the exam objectives is covered 
in this book. In addition, each chapter opens with a list of the exam 
objectives it covers. Use these to see exactly where each of the exam topics 
is covered. 


Exam Essentials 


Each chapter, just after the summary, includes a number of exam essentials. 
These are the key topics you should take from the chapter in terms of areas 
to focus on when preparing for the exam. 


Chapter Review Questions 


To test your knowledge as you progress through the book, there are review 
questions at the end of each chapter. As you finish each chapter, answer the 
review questions and then check your answers—the correct answers and 
explanations are in Appendix A. You can go back to reread the section that 
deals with each question you got wrong to ensure that you answer correctly 
the next time you're tested on the material. 
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The review questions, assessment test, and other testing elements included in 
this book are not derived from the actual exam questions, so don't memorize 
the answers to these questions and assume that doing so will enable you to 
pass the exam. You should learn the underlying topic, as described in the 
text of the book. This will help you answer the questions provided with this 
book and pass the exam. Learning the underlying topic is also the approach 


that will serve you best in the workplace—the ultimate goal of a 
certification. 


To get the most out of this book, you should read each chapter from start to 
finish and then check your memory and understanding with the end-of-chapter 
elements. Even if you're already familiar with a topic, you should skim the 
chapter; Linux is complex enough that there are often multiple ways to 
accomplish a task, so you may learn something even if you're already competent 
in an area. 


Interactive Online Learning Environment and Test Bank 


The interactive online learning environment that accompanies the book provides 
a test bank with study tools to help you prepare for the certification exam—and 
increase your chances of passing it the first time! The test bank includes the 
following: 


Sample Tests 


All of the questions in this book are provided, including the Assessment 
Test, which you'll find at the end of this introduction, and the Chapter Tests 
that include the Review Questions at the end of each chapter. In addition, 
there are two Practice Exams. Use these questions to test your knowledge 
of the study guide material. The online test bank runs on multiple devices. 


Flashcards 


Questions are provided in digital flashcard format (a question followed by a 
single correct answer). You can use the flashcards to reinforce your 
learning and provide last-minute test prep before the exam. 


Other Study Tools 


A glossary of key terms from this book and their definitions are available as 
a fully searchable PDF. 
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Go to http://sybextestbanks.wiley.com to register and gain access to this 
interactive online learning environment and test bank with study tools. 





Conventions Used in This Book 


This book uses certain typographic styles in order to help you quickly identify 
important information and to avoid confusion over the meaning of words such as 
onscreen prompts. In particular, look for the following styles: 


e Italicized text indicates key terms that are described at length for the first 


time in a chapter. (Italics are also used for emphasis.) 


e A monospaced font indicates the contents of configuration files, messages 


displayed at a text-mode Linux shell prompt, filenames, text-mode 
command names, and Internet URLs. 


Italicized monospaced text indicates a variable—information that 
differs from one system or command run to another, such as the name of a 
client computer or a process ID number. 


Bold monospaced text is information that you're to type into the computer, 
usually at a Linux shell prompt. This text can also be italicized to indicate 
that you should substitute an appropriate value for your system. (When 
isolated on their own lines, commands are preceded by non-bold 
monospaced $ or # command prompts, denoting regular user or system 
administrator use, respectively.) 


In addition to these text conventions, which can apply to individual words or 
entire paragraphs, a few conventions highlight segments of text: 


x 


A note indicates information that's useful or interesting but that's somewhat 
peripheral to the main text. A note might be relevant to a small number of 
networks, for instance, or it may refer to an outdated feature. 


w 


A tip provides information that can save you time or frustration and that may 
not be entirely obvious. A tip might describe how to get around a limitation 
or how to use a feature to perform an unusual task. 
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Warnings describe potential pitfalls or dangers. If you fail to heed a warning, 


you may end up spending a lot of time recovering from a bug, or you may 
even end up restoring your entire system from scratch. 


Sidebar 


A sidebar is like a note but longer. The information in a sidebar is useful, but 
it doesn't fit into the main flow of the text. 





= Real World Scenario 
Real World Scenario 


A real-world scenario is a type of sidebar that describes a task or example 
that's particularly grounded in the real world. This may be a situation we or 
somebody we know has encountered, or it may be advice on how to work 
around problems that are common in real-world, working Linux 
environments. 


Exercise 


An exercise is a procedure that you should try on your own computer to help 
you learn about the material in the chapter. Don't limit yourself to the 
procedures described in the exercises though! Try other commands and 
procedures to truly learn about Linux. 





The Exam Objectives 


Behind every computer industry exam, you can be sure to find exam objectives 
—the broad topics in which exam developers want to ensure your competency. 
The official exam objectives are listed here. (They're also printed at the start of 
the chapters in which they're covered.) 


x 


Exam objectives are subject to change at any time without prior notice and at 
CompTIA's sole discretion. Please visit CompTIA's website 
(www.CompTIA.org) for the most current listing of exam objectives. 


Exam LX0-103 Objectives 


Following are the areas in which you must be proficient in order to pass the 
LX0-103 exam. This exam is broken into four topics (101—104), each of which 
has three to eight objectives. Each objective has an associated weight, which 
reflects its importance to the exam as a whole. The four main topics are as 
follows: 


Subject Area 

101 System Architecture 

102 Linux Installation and Package Management 

103 GNU and Unix Commands 

104 Devices, Linux Filesystems, Filesystem Hierarchy Standard 


101 System Architecture 


101.1 Determine and configure hardware settings (Chapter 3) 


Enable and disable integrated peripherals 

Configure systems with or without external peripherals such as keyboards 
Differentiate between the various types of mass storage devices 

Know the differences between coldplug and hotplug devices 

Determine hardware resources for devices 


Tools and utilities to list various hardware information (e.g., lsusb, lspci, 
etc.) 


Tools and utilities to manipulate USB devices 
Conceptual understanding of sysfs, udev, hald, dbus 


The following is a partial list of the files, terms, and utilities covered in this 
objective: /sys, /proc, /dev, modprobe, lsmod, lspci, lsusb 


101.2 Boot the system (Chapter 5) 


Provide common commands to the boot loader and options to the kernel at 
boot time 


Demonstrate knowledge of the boot sequence from BIOS to boot 
completion 


Understanding of SysVinit and systemd 
Awareness of Upstart 
Check boot events in the log file 


The following is a partial list of the files, terms and utilities covered in this 
objective: dmesg, BIOS, bootloader, kernel, init, initramfs, SysVinit, 
systemd 


101.3 Change runlevels/boot targets and shutdown or reboot 
system (Chapter 5) 


Set the default runlevel or boot target 
Change between runlevels/boot targets, including single user mode 
Shutdown and reboot from the command line 


Alert users before switching runlevels/boot targets or other major system 
events 


Properly terminate processes 


The following is a partial list of the files, terms and utilities covered in this 
objective: etcinittab, shutdown, init, etcinit.d, telinit, systemd, 
systemctl, etcsystemd/, usrlib/systemd/, wall 


102 Linux Installation and Package Management 


102.1 Design hard disk layout (Chapter 3) 


Allocate filesystems and swap space to separate partitions or disks 
Tailor the design to the intended use of the system 


Ensure that the /boot partition conforms to the hardware architecture 
requirements for booting 


Knowledge of basic features of LVM 


The following is a partial list of the files, terms and utilities covered in this 
objective: / (root) filesystem, /var filesystem, /home filesystem, /boot 
filesystem, swap space, mount points, partitions 


102.2 Install a boot manager (Chapter 5) 
e Providing alternative boot locations and backup boot options 
e Install and configure a boot loader such as GRUB Legacy 
e Perform basic configuration changes for GRUB 2 
e Interact with the boot loader 
e The following is a partial list of the files, terms, and utilities covered in this 
objective: /boot/grub/menu.1st, grub.cfg and grub.conf, grub-install, 
grub-mkconfig, MBR 
102.3 Manage shared libraries (Chapter 2) 
e Identify shared libraries 
e Identify the typical locations of system libraries 
e Load shared libraries 
e The following is a partial list of the files, terms and utilities covered in this 
objective: 1dd, ldconfig, etcld.so.conf, LD_LIBRARY_PATH 
102.4 Use Debian package management (Chapter 2) 
e Install, upgrade, and uninstall Debian binary packages 


e Find packages containing specific files or libraries which may or may not 
be installed 


e Obtain package information like version, content, dependencies, package 
integrity, and installation status (whether or not the package is installed) 


e The following is a partial list of the files, terms and utilities covered in this 
objective: etcapt/sources.list, dpkg, dpkg-reconfigure, apt-get, apt- 
cache, aptitude 

102.5 Use RPM and YUM package management (Chapter 2) 
e Install, reinstall, upgrade. and remove packages using RPM and YUM 


e Obtain information on RPM packages such as version, status, dependencies, 
integrity, and signatures 


e Determine what files a package provides, as well as find which package a 
specific file comes from 


The following is a partial list of the files, terms and utilities covered in this 
objective: rpm, rpm2cpio, etcyum.conf, etcyum.repos.d/, yum, 
yumdownloader 


103 GNU and Unix Commands 


103.1 Work on the command line (Chapter 1) 


Use single shell commands and one-line command sequences to perform 
basic tasks on the command line 


Use and modify the shell environment. including defining, referencing, and 
exporting environment variables 


Use and edit command history 
Invoke commands inside and outside the defined path 


The following is a partial list of the files, terms, and utilities covered in this 
objective: bash, echo, env, exec, export, pwd, set, unset, man, uname, 
history, .bash_history 


103.2 Process text streams using filters (Chapter 1) 


Send text files and output streams through text utility filters to modify the 
output using standard Unix commands 


The following is a partial list of the files, terms, and utilities covered in this 
objective: cat, cut, expand, fmt, head, od, join, less, nl, paste, pr, sed, 
sort, split, tail, tr, unexpand, uniq, wc 


103.3 Perform basic file management (Chapter 4) 


Copy, move, and remove files and directories individually 
Copy multiple files and directories recursively 

Remove files and directories recursively 

Use simple and advanced wildcard specifications in commands 
Using find to locate and act on files based on type, size, or time 
Usage of tar, cpio, and dd 


The following is a partial list of the files, terms and utilities covered in this 
objective: cp, find, mkdir, mv, ls, rm, rmdir, touch, tar, cpio, dd, file, 


gzip, gunzip, bzip2, xz, file globbing 


103.4 Use streams, pipes, and redirects (Chapter 1) 


Redirecting standard input, standard output, and standard error 
Pipe the output of one command to the input of another command 
Use the output of one command as arguments to another command 
Send output to both STDOUT and a file 


The following is a partial list of the files, terms and utilities covered in this 
objective: tee, xargs 


103.5 Create, monitor, and kill processes (Chapter 2) 


Run jobs in the foreground and background 
Signal a program to continue running after logout 
Monitor active processes 

Select and sort processes for display 

Send signals to processes 


The following is a partial list of the files, terms and utilities covered in this 
objective: & bg, fg, jobs, kill, nohup, ps, top, free, uptime, pgrep, 
pkill, killall, screen 


103.6 Modify process execution priorities (Chapter 2) 


Know the default priority of a job that is created 
Run a program with higher or lower priority than the default 
Change the priority of a running process 


The following is a partial list of the files, terms, and utilities covered in this 
objective: nice, ps, renice, top 


103.7 Search text files using regular expressions (Chapter 1) 


Create simple regular expressions containing several notational elements 


Use regular expression tools to perform searches through a filesystem or 
file content 


e The following is a partial list of the files, terms and utilities covered in this 
objective: grep, egrep, fgrep, sed, regex(7) 
103.8 Perform basic file editing operations using vi (Chapter 5) 
e Navigate a document using vi 
e Use basic vi modes 
e Insert, edit, delete, copy, and find text 
e The following is a partial list of the files, terms and utilities covered in this 


objective: vi, /, ?, h, j, k, 1, i, 0, a, c, d, p, y, dd, yy, ZZ, :w!, :q!, :e! 


104 Devices, Linux Filesystems, Filesystem Hierarchy 
Standard 


104.1 Create partitions and filesystems (Chapter 3) 
e Manage MBR partition tables 


e Use various mkfs commands to create various filesystems, such as ext2, 
ext3, ext4, xfs, vfat 


e Awareness of ReiserFS and Birfs 
e Basic knowledge of gdisk and parted with GPT 
e The following is a partial list of the files, terms, and utilities covered in this 
objective: fdisk, gdisk, parted, mkfs, mkswap 
104.2 Maintain the integrity of filesystems (Chapter 3) 
e Verify the integrity of filesystems 
e Monitor free space and inodes 
e Repair simple filesystem problems 
e The following is a partial list of the files, terms, and utilities covered in this 
objective: du, df, fsck, e2fsck, mke2fs, debugfs, dumpe2fs, tune2fs, xfs 
tools (such as xfs_metadump and xfs_info) 
104.3 Control mounting and unmounting of filesystems (Chapter 3) 


e Manually mount and unmount filesystems 


e Configure filesystem mounting on bootup 
e Configure user mountable removeable filesystems 
e The following is a partial list of the files, terms, and utilities covered in this 
objective: etcfstab, /media, mount, umount 
104.4 Manage disk quotas (Chapter 4) 
e Set up a disk quota for a filesystem 
e Edit, check, and generate user quota reports 
e The following is a partial list of the files, terms, and utilities covered in this 
objective: quota, edquota, repquota, quotaon 
104.5 Manage file permissions and ownership (Chapter 4) 


e Manage access permissions on regular and special files as well as 
directories 


e Use access modes such as SUID, SGID, and the sticky bit to maintain 
security 


e Know how to change the file creation mask 
e Use the group field to grant file access to group members 
e The following is a partial list of the files, terms, and utilities covered in this 
objective: chmod, umask, chown, chgrp 
104.6 Create and change hard and symbolic links (Chapter 4) 
e Create links 
e Identify hard and/or soft links 
e Copying versus linking files 
e Use links to support system administration tasks 


e This utility is covered in this objective: 1n, 1s 


104.7 Find system files and place files in the correct location 
(Chapter 4) 


e Understand the correct locations of files under the FHS 


e Find files and commands on a Linux system 


e Know the location and purpose of important files and directories as defined 
in the FHS 


e The following is a partial list of the files, terms, and utilities covered in this 
objective: find, locate, updatedb, whereis, which, type, 
etcupdatedb.conf 


Exam LX0-104 Objectives 


The LX0-104 exam comprises six topics (105—110), each of which contains 
three or four objectives. The six major topics are as follows: 


Subject Area 

105 Shells, Scripting, and Data Management 
106 User Interfaces and Desktops 

107 Administrative Tasks 

108 Essential System Services 

109 Networking Fundamentals 

110 Security 


105 Shells, Scripting, and Data Management 


105.1 Customize and use the shell environment (Chapter 9) 


Set environment variables (e.g., PATH) at login or when spawning a new 
shell 


Write bash functions for frequently used sequences of commands 
Maintain skeleton directories for new user accounts 
Set command search path with the proper directory 


The following is a partial list of the files, terms, and utilities covered in this 
objective: source, etcbash.bashrc, etcprofile, env, export, set, unset, 
~/.bash_profile, ~/.bash_login, ~/. profile, ~/.bashrc, 
~/.bash_logout, function, alias, lists 


105.2 Customize or write simple scripts (Chapter 9) 


Use standard sh syntax (loops, tests) 
Use command substitution 


Test return values for success or failure or other information provided by a 
command 


Perform conditional mailing to the superuser 


e Correctly select the script interpreter through the shebang (#!) line 
e Manage the location, ownership, execution, and SUID rights of scripts 
e The following is a partial list of the files, terms, and utilities covered in this 
objective: for, while, test, if, read, seq, exec 
105.3 SQL data management (Chapter 9) 
e Use of basic SQL commands 
e Perform basic data manipulation 


e The following is a partial list of the files, terms, and utilities covered in this 
objective: insert, update, select, delete, from, where, group by, order 
by, join 


106 User Interfaces and Desktops 


106.1 Install and configure X11 (Chapter 6) 
e Verify that the video card and monitor are supported by an X server 
e Awareness of the X font server 
e Basic understanding and knowledge of the X Window configuration file 
e The following is a partial list of the files, terms, and utilities covered in this 
objective: etcx11/xorg.conf, xhost, DISPLAY, xwininfo, xdpyinfo, X 
106.2 Set up a display manager (Chapter 6) 
e Basic configuration of LightDM 
e Turn the display manager on or off 
e Change the display manager greeting 
e Awareness of XDM, KDM, and GDM 
e The following is a partial list of the files, terms, and utilities covered in this 
objective: lightdm, etclightdm 
106.3 Accessibility (Chapter 6) 
e Basic knowledge of keyboard accessibility settings (AccessX) 


e Basic knowledge of visual settings and themes 


Basic knowledge of assistive technologies (ATs) 


The following is a partial list of the files, terms, and utilities covered in this 
objective: sticky/repeat keys, slow/bounce/toggle keys, mouse keys, high 
contrast/large Print Desktop themes, screen reader, Braille display, screen 
magnifier, onscreen keyboard, Gestures (used at login; for example, gdm), 
Orca, GOK, emacspeak 


107 Administrative Tasks 


107.1 Manage user and group accounts and related system files 
(Chapter 7) 


Add, modify, and remove users and groups 
Manage user/group info in password/group databases 
Create and manage special-purpose and limited accounts 


The following is a partial list of the files, terms, and utilities covered in this 
objective: etcpasswd, etcshadow, etcgroup, etcskel, chage, getent, 
groupadd, groupdel, groupmod, passwd, useradd, userdel, usermod 


107.2 Automate system administration tasks by scheduling jobs 
(Chapter 7) 


Manage cron and at jobs 
Configure user access to cron and at services 
Configure anacron 


The following is a partial list of the files, terms, and utilities covered in this 
objective: etccron. {d, daily, hourly, monthly, weekly}, etcat.deny, 
etcat.allow, etccrontab, etccron.allow, etccron.deny, 
varspool/cron/*, crontab, at, atq, atrm, anacron, etcanacrontab 


107.3 Localization and internationalization (Chapter 6) 


Configure locale settings and environment variables 
Configure time zone settings and environment variables 


The following is a partial list of the files, terms, and utilities covered in this 
objective: etctimezone, etclocaltime, usrshare/zoneinfo, environment 
variables (LC_*, LC_ALL, LANG, TZ), usrbin/locale, tzselect, tzconfig, 


date, iconv, UTF-8, ISO-8859, ASCII, Unicode 


108 Essential System Services 


108.1 Maintain system time (Chapter 7) 


Set the system date and time 

Set the hardware clock to the correct time in UTC 
Configure the correct time zone 

Basic NTP configuration 

Knowledge of using the pool.ntp.org service 
Awareness of the ntpg command 


The following is a partial list of the files, terms, and utilities covered in this 
objective: usrshare/zoneinfo, etctimezone, etclocaltime, etcntp.conf, 
date, hwclock, ntpd, ntpdate, pool.ntp.org 


108.2 System logging (Chapter 7) 


Configuration of the syslog daemon 

Understanding of standard facilities, priorities, and actions 
Configuration of logrotate 

Awareness of rsyslog and syslog-ng 


The following is a partial list of the files, terms, and utilities covered in this 
objective: syslog.conf, syslogd, klogd, varlog, logger, logrotate, 
etclogrotate.conf, etclogrotate.d/, journalctl, 
etcsystem/journal.conf, varlog/journal/ 


108.3 Mail Transfer Agent (MTA) basics (Chapter 9) 


Create email aliases 
Configure email forwarding 


Knowledge of commonly available MTA programs (postfix, sendmail, 
qmail, exim) (no configuration) 


The following is a partial list of the files, terms, and utilities covered in this 
objective: ~/.forward, sendmail emulation layer commands, newaliases, 


mail, mailgq, postfix, sendmail, exim, qmail 


108.4 Manage printers and printing (Chapter 6) 


Basic CUPS configuration (for local and remote printers) 
Manage user print queues 

Troubleshoot general printing problems 

Add and remove jobs from configured printer queues 


The following is a partial list of the files, terms, and utilities covered in this 
objective: CUPS configuration files, tools and utilities; etccups; 1pd legacy 
interface (lpr, lprm, 1pq) 


109 Networking Fundamentals 


109.1 Fundamentals of Internet protocols (Chapter 8) 


Demonstrate an understanding of network masks and CIDR notation 


Knowledge of the differences between private and public “dotted quad” IP 
addresses 


Knowledge about common TCP and UDP ports (20, 21, 22, 23, 25, 53, 80, 
110, 123, 139, 143, 161, 162, 389, 443, 465, 514, 636, 993, 995) 


Knowledge about the differences and major features of UDP, TCP, and 
ICMP 


Knowledge of the major differences between IPv4 and IPV6 
Knowledge of the basic features of IPv6 


The following is a partial list of the files, terms, and utilities covered in this 
objective: etcservices, IPv4, IPv6, subnetting, TCP, UDP, ICMP 


109.2 Basic network configuration (Chapter 8) 


Manually and automatically configure network interfaces 
Basic TCP/IP host configuration 
Setting a default route 


The following is a partial list of the files, terms, and utilities covered in this 
objective: etchostname, etchosts, etcnsswitch.conf, ifconfig, ifup, 


ifdown, ip, route, ping 


109.3 Basic network troubleshooting (Chapter 8) 


Manually and automatically configure network interfaces and routing tables 
to include adding, starting, stopping, restarting, deleting, or reconfiguring 
network interfaces 


Change, view, or configure the routing table and correct an improperly set 
default route manually 


Debug problems associated with the network configuration 


The following is a partial list of the files, terms, and utilities covered in this 
objective: ifconfig, ip, ifup, ifdown, route, host, hostname, dig, 
netstat, ping, ping6, traceroute, traceroute6, tracepath, tracepathé6, 
netcat 


109.4 Configure client-side DNS (Chapter 8) 


Query remote DNS servers 
Configure local name resolution and use remote DNS servers 
Modify the order in which name resolution is done 


The following is a partial list of the files, terms, and utilities covered in this 
objective: etchosts, etcresolv.conf, etcnsswitch.conf, host, dig, 
getent 


110 Security 


110.1 Perform security administration tasks (Chapter 10) 


Audit a system to find files with the SUID/SGID bit set 

Set or change user passwords and password aging information 

Be able to use nmap and netstat to discover open ports on a system 

Set up limits on user logins, processes, and memory usage 

Determine which users have logged in to the system or are currently logged 
in 


Basic sudo configuration and usage 


The following is a partial list of the files, terms, and utilities covered in this 
objective: find, passwd, lsof, nmap, chage, netstat, sudo, etcsudoers, 
su, usermod, ulimit, who, w, last 


110.2 Set up host security (Chapter 10) 


Awareness of shadow passwords and how they work 
Turn off network services not in use 
Understand the role of TCP wrappers 


The following is a partial list of the files, terms, and utilities covered in this 
objective: etcnologin, etcpasswd, etcshadow, etcxinetd.d/*, 
etcxinetd.conf, etcinetd.d/*, etcinetd.conf, etcinittab, 
etcinit.d/*, etchosts.allow, etchosts.deny 


110.3 Securing data with encryption (Chapter 10) 


Perform basic OpenSSH 2 client configuration and usage 
Understand the role of OpenSSH 2 server host keys 
Perform basic GnuPG configuration and usage 
Understand SSH port tunnels (including X11 tunnels) 


The following is a partial list of the files, terms, and utilities covered in this 
objective: ssh, ssh-keygen, ssh-agent, ssh-add, ~/.ssh/id_rsa and 
id_rsa.pub, ~/.ssh/id_dsa and id_dsa.pub, etcssh/ssh_host_rsa_key 
and ssh_host_rsa_key.pub, etcssh/ssh_host_dsa_key and 
ssh_host_dsa_key.pub, ~/.ssh/authorized_keys, etcssh_known_hosts, 
gpg, ~/.gnupg/* 


Assessment Test 


1. Which section in the X server configuration file defines the combination of 
monitors and video cards that you're using on your Linux system? 


A. Monitor 
B. Screen 
C. Modeline 
D. Device 
E. Module 


2. How can you tell whether your system is using inetd or xinetd as a Super 
server? (Select two.) 


A. Type ps ax | grep inetd, and examine the output for signs of inetd or 
xinetd. 


B. Type superserver to see a report on which super server is running. 


C. Look for the etcinetd. conf file or etcxinetd.d subdirectory, which are 
signs of inetd or xinetd, respectively. 


D. Examine the etcinittab file to see which super server is launched by init, 
which is responsible for this task. 


E. Type netstat -a | grep inet and examine the output for signs of inetd 
or xinetd. 


3. How does the 1pc utility for CUPS differ from its counterpart in BSD LPD 
and LPRng? 


A. The 1pc utility is unique to CUPS; it doesn't ship with BSD LPD or LPRng. 
B. CUPS doesn't ship with an 1pc command, but BSD LPD and LPRng do. 


C. CUPS's 1pc is much more complex than its counterpart in BSD LPD and 
LPRog. 


D. CUPS's 1pc is much simpler than its counterpart in BSD LPD and LPRng. 
E. The 1pc utility is identical in all three of these printing systems. 


4. What file would you edit to restrict the number of simultaneous logins a user 


can employ? 


A. etcpam.d/login-limits 


B. etcbashrc 


C. etcsecurity/limits.conf 


D. etcinittab 


E. 


etcpasswd 


5. Which of the following are required when configuring a computer to use a 
static IP address? (Select two.) 


A. The IP address of the DHCP server 


B. 


The hostname of the NBNS server 


C. The computer's IP address 


D. The network mask 


E. 


The IP address of the NTP server 


6. What does the following command accomplish? 


E 


$ wc report.txt | tee wc 


. It launches the we editor on both the report.txt and wc. txt files; each file 


opens in its own window. 


. It displays a count of the windows in which the report. txt file is displayed 


and shows that information in a new window called wc. 


. It creates a count of newlines, words, and bytes in the report.txt file and 


then displays a count of these statistics about the report it just generated. 


. It cleans up any memory leaks associated with the tee program's use of the 


report.txt file. 


. It displays a count of newlines, words, and bytes in the report.txt file and 


copies that output to the we file. 


7. Which of the following characters defines the end of an OS or kernel 
definition in bootgrub/grub.cfg? 


As 


B. 


) 


C. } 
D. */ 


E. None of the above; the definition ends with the title line beginning the 
next entry. 


8. What does the number 703 represent in the following etcpasswd entry? 


george: x: 703:100:George Brown: /home/george:/bin/tcsh 


A. The account's human ID (HID) number 
B. The account's process ID (PID) number 
C. The account's group ID (GID) number 
D. The account's globally unique ID (GUID) number 
E. The account's user ID (UID) number 
9. What does the grep command accomplish? 
A. It creates a pipeline between two programs. 
B. It searches files' contents for a pattern. 
C. It concatenates two or more files. 
D. It displays the last several lines of a file. 
E. It locates files on the hard disk. 
10. Which of the following are journaling filesystems for Linux? (Select three.) 
A. vfat 
B. ReiserFS 
C. Ext2fs 
D. Ext3fs 
E. XFS 


11. You've configured your computer to use SMTP and IMAP via a tunneled 
SSH connection to your ISP's email server for improved security. Why might 
you still want to use GPG encryption for your emails on top of the encryption 
provided by SSH? 


A. The SSH tunnel reaches only as far as the first email server; GPG encrypts 


data on all of the computers all the way to or from your email 
correspondents. 


B. SSH encryption is notoriously poor for email, although it's perfectly 
adequate for login sessions; thus, adding GPG encryption improves 
security. 


C. SSH doesn't encrypt the headers of the email messages; GPG encrypts the 
headers to keep snoopers from learning your correspondents’ identities. 


D. Using GPG guarantees that your email messages won't contain unwanted 
viruses or worms that might infect your correspondents’ computers. 


E. Configured in this way, SSH will encrypt the email headers and bodies but 
not any attachments to your email. 


12. Which of the following ports are commonly used to retrieve email from an 
email server computer? (Select two.) 


A. 110 
B. 119 
C. 139 
D. 143 
E. 443 


13. You're experiencing sporadic problems with a Secure Shell (SSH) login 
server—sometimes users can log in and sometimes they can't. What might 
you try immediately after a failure to help diagnose this problem? 


A. On the server computer, type http://localhost : 631 into a web browser to 
access the SSH configuration page and check its error subpage for error 
messages. 


B. Type diagnose sshd to run a diagnostic on the SSH server daemon (sshd). 
C. Type tail varlog/messages to look for error messages from the server. 
D. Examine the devssh device file to look for error messages from the server. 
E. On the server computer, type sshd to view SSH's diagnostic messages. 

14. What is the function of the ~/. profile file? 


A. It's the user configuration file for the ProFTP server. 


B. It's one of a user's bash startup scripts. 

C. It's the user configuration file for the ProFile file manager. 
D. Its presence tells tcsh to ignore file modes. 

E. It holds the user's encrypted password. 


15. You want your computer to remind you to get your car inspected in two 
years. What is the best way to do this among the specified options? 


A. Create a program that repeatedly checks the time and, when two years have 
passed, displays a message to get your car inspected. 


B. Type cal day month year, where day, month, and year specify the date of 
the future inspection, to have Linux run a program that you then specify on 
that date. 


C. Create a cron job that runs hourly. This job should check the date and, 
when the correct date comes up, use mail to notify you of the need for a car 
inspection. 


D. Use the NTP GUI calendar program to create an alarm for the specified 
date. The program will then display the message you enter at the specified 
date and time. 


E. Type at date, where date is a date specification. You can then specify a 
command, such as mail with appropriate options, to notify you of the need 
to get your car inspected. 


16. How would you configure a computer to use the computer whose IP address 
is 172.24.21.1 as a gateway for all network traffic that's not otherwise 
configured? 


A. gateway default 172.24.21.1 
B. gateway 172.24.21.1 
C. route gateway 172.24.21.1 
D. route add default gw 172.24.21.1 
E. gw 172.24.21.1 
17. What software can you use to drive a Braille display device? (Select two.) 
A. Emacspeak 
B. BRLTTY 


C. A 2.6.26 or later kernel 
D. GOK 
E. A framebuffer driver 
18. Which is true of source RPM packages? 


A. They consist of three files: an original source tarball, a patch file of 
changes, and a PGP signature indicating the authenticity of the package. 


B. They require programming knowledge to rebuild. 


C. They can sometimes be used to work around dependency problems with a 
binary package. 


D. They are necessary to compile software for RPM-based distributions. 
E. They always contain software that's licensed under terms of the GPL. 


19. Which utility should you use by itself to rename the file pumpkin. txt to 
lantern.txt? 


A. dd 
B. rm 
C. cp 
D. mv 
E. 1n 


20. You want to run a lengthy scientific simulation program, called simbigbang, 
which doesn't require any user interaction; the program operates solely on 
disk files. If you don't want to tie up the shell from which you run the 
program, what should you type to run simbigbang in the background? 


A. start simbigbang 

B. simbigbang & 

C. bg simbigbang 

D. background simbigbang 
E. nice simbigbang 


21. Which of the following commands will install an RPM package file called 
theprogram-1.2.3-4.i386.rpm on a computer? (Select two.) 


. rpm -Uvh theprogram-1.2.3-4.1386.rpm 
rpm -i theprogram-1.2.3-4.1386.rpm 
. rpm -U theprogram 


rpm -e theprogram-1.2.3-4.1386.rpm 


moa wm > 


. rpm -Vp theprogram-1.2.3-4.1386.rpm 
22. What tool can diagnose and fix many common Linux filesystem problems? 
A. mkfs 
B. fsck 
C. chkdsk 
D. scandisk 
E. fdisk 


23. You've just installed MySQL, and you intend to use it to store information 
about the animals in a zoo, from the anteaters to the zebras. What command 
are you likely to use first, once you start MySQL? 


A. CREATE DATABASE animals; 
B. USE animals; 

C. CREATE TABLE animals; 

D. INSERT INTO animals; 

E. UPDATE animals; 


24. Which of the following commands displays help on topic, when typed in a 
Linux shell? (Select two.) 


A. manual topic 
B. man topic 
C.? topic 

D. info topic 
E. hint topic 


25. A computer's hardware clock keeps track of the time while the computer is 
powered off. In what formats may this time be stored on an x86 Linux 
system? (Select two.) 


A. Coordinated Universal Time (UTC) 
B. Internet Time 

C. Local time 

D. 12-hour time 

E. Mars time 


26. You want to know what kernel modules are currently loaded. What 
command would you type to learn this information? 


A. insmod 
B. depmod 
C. modprobe 
D. 1smod 

E. modinfo 


27. You want to enable all members of the music group to read the 
instruments.txt file, which currently has 0640 (-rw-r----- ) permissions, 
ownership by root, and group ownership by root. How might you 
accomplish this goal? (Select two.) 


A. Type chown music instruments. txt in the file's directory. 
B. Type chgrp music instruments.txt in the file's directory. 
C. Type chgroup music instruments.txt in the file's directory. 
D. Type chmod 0600 instruments. txt in the file's directory. 

E. Type chown :music instruments. txt in the file's directory. 


28. You want to create a link to the usrlocal/bin directory in another location. 
Which of the following statements is true? 


A. You can do this only if usrlocal/bin is on a journaling filesystem. 
B. You must own usrlocal/bin to create the link. 


C. You can create the link only if the link's location is on the same filesystem 
as the original directory. 


D. Only the system administrator can do this. 


E. The link will probably have to be a symbolic link. 


29. Which of the following, when typed in vi's command mode, saves a file and 
quits the program? (Select two.) 


A. :rq 
B. :wq 
C. :re 
D. :we 
E. ZZ 


30. A user's home directory includes a file called ~/. forward that consists of 
one line: |~/junkme. What is the effect of this configuration? 


A. The user's incoming mail is forwarded to the junkme user on the same 
system. 


B. The user's incoming mail is stored in the ~/junkme file. 
C. The user's incoming mail is sent through the ~/junkme program file. 
D. The user's incoming mail is flagged as spam and deleted. 


E. The user's incoming mail is forwarded to the same user on the junkme 
computer. 


Answers to the Assessment Test 


1. B. The Monitor section defines the monitor options and settings but doesn't 
combine it with the video card, so option A is incorrect. The Modeline line 
defines the available video modes in the Monitor section, but it doesn't 
define video cards, so option C is incorrect. Option D, the Device section, is 
also incorrect; it defines the video card but doesn't match it with a monitor 
on the system. Option E is incorrect because the Module section defines 
which X server modules (or drivers) are loaded but it doesn't match 
monitors and video cards. Option B, the Screen section, tells the X server 
about the combination of video cards and monitors that you're using, so it's 
the correct answer. For more information, see Chapter 6, “Configuring the 
X Window System, Localization, and Printing.” 


2. A, C. Examining a process listing (obtained from ps) for signs of the super 
server is the most reliable way to determine which one is actually running, 
so option A is correct. The presence of the super server's configuration file 
or files (as in option C) is also a good diagnostic, although some older 
systems that have been upgraded may have both sets of configuration files. 
There is no standard superserver utility to report on which one is used, so 
option B is incorrect. Most distributions launch the super server through a 
SysV startup script; the etcinittab file isn't directly involved in this 
process, so examining it would be pointless, and option D is incorrect. 
Although the output of netstat -ap, when typed as root, will include an 
indication of any instance of inetd or xinetd that's listening for 
connections, option E omits the critical -p option, which causes the 
program to display process names. Thus, option E is incorrect. For more 
information, see Chapter 10, “Securing Your System.” 


3. D. The 1pc utility is used to start, stop, change the priority of, and otherwise 
control jobs in a print queue. CUPS ships with an 1pc utility, but it's quite 
rudimentary compared to the 1pc utilities of BSD LPD and LPRng. Instead, 
CUPS relies on its Web-based interface to provide the ability to control 
print jobs. Thus, option D is correct, and the remaining options must 
logically all be incorrect. For more information, see Chapter 6. 


4. C. The etcsecurity/limits.conf file defines various limits on user 
resources, including the number of simultaneous logins individual users are 
permitted. Thus, option C is correct. The etcpam.d/login-1limits file 


(option A) is fictitious, although login limits do rely on the pam_limits 
module to the Pluggable Authentication System (PAM). The etcbashrc file 
(option B) is a global bash startup script file, but it's not normally used to 
impose login limits. The etcinittab file (option D) is a key Linux startup 
file, but it doesn't have any direct bearing on imposing login limits. The 
etcpasswd file (option E) defines many key account features, but login 
limits are not among these. For more information, see Chapter 10. 


5. C, D. The computer's IP address (option C) and network mask (aka subnet 
mask or netmask; option D) are the most critical components in TCIP/IP 
network configuration. (Additional information that you may need to 
provide on many networks includes the IP addresses of one to three DNS 
servers, the hostname or IP address of a router, and the computer's 
hostname.) You shouldn't need the IP address of a Dynamic Host 
Configuration Protocol (DHCP) server (option A)—and if a DHCP server is 
present, chances are you should be using DHCP rather than static IP 
address assignment. A NetBIOS Name Service (NBNS) server (option B) 
converts between names and IP addresses on NetBIOS networks. The 
hostname of such a computer isn't likely to be a critical configuration 
element, although you may need to provide this information to Samba for 
some operations to function correctly when sharing files. A Network Time 
Protocol (NTP) server (option E) helps you maintain system time on all of 
your computers, but this isn't required for basic network configuration. For 
more information, see Chapter 8, “Configuring Basic Networking.” 


6. E. The wc command displays a count of newlines, words, and bytes in the 
specified file (report.txt). Piping this data through tee causes a copy of 
the output to be stored in the new file (wc in this example—you shouldn't 
run this command in the same directory as the wc executable file!). Thus, 
option E is correct. Contrary to option A, wc is not an editor, and the 
remaining syntax wouldn't cause two files to open in separate windows 
even if wc were an editor. Contrary to option B, we doesn't count windows 
or open a new window. Option C describes the effect of wc report | wc— 
that is, it overlooks the tee command. Contrary to option D, wc has nothing 
to do with cleaning up memory leaks, and tee doesn't directly use the 
report.txt file. For more information, see Chapter 1, “Exploring Linux 
Command-Line Tools.” 


7. C. The grub.cfg filename indicates a GRUB 2 configuration file. In such 
files, each OS or kernel stanza begins with a menuentry line and an open 


curly brace ({) and ends with a close curly brace (}). Thus, option C is 
correct. Some configuration files and programming languages use 
semicolons (;) at the end of most lines, but this isn't true of GRUB 2, so 
option A is incorrect. Although close parentheses ()) are used to terminate 
some types of options in some configuration files, including disk identifiers 
in GRUB 2's configuration file, they aren't used to terminate whole OS or 
kernel definitions in this file, so option B is incorrect. The string */ 
terminates comments in C program files but isn't commonly used in GRUB 
2 configuration files, so option D is incorrect. Option E would be correct if 
the question had asked about a GRUB Legacy configuration file (menu. 1st 
or grub.conf), but the question specifies a GRUB 2 configuration file 
(grub.cfg); the two boot loaders terminate their OS/kernel stanzas 
differently, so option E is incorrect. For more information, see Chapter 5, 
“Booting Linux and Editing Files.” 


8. E. The third field of etcpasswd entries holds the UID number for the 
account, so option E is correct. Linux doesn't use any standard identifier 
called a human ID (HID; option A), although the acronym HID stands for 
human interface device, a class of USB devices. Accounts don't have PID 
numbers (option B); those belong to running processes. The account's GID 
number (option C) is stored in the fourth field of etcpasswd—100 in this 
example. Linux accounts don't use globally unique ID (GUID) numbers, so 
option D is incorrect. For more information, see Chapter 7, “Administering 
the System.” 


9. B. The grep command scans files to find those that contain a specified string 
or pattern, as described by option B. In the case of text files, grep displays 
the matching line or lines; for binary files, it reports that the file matches 
the pattern. The method of creating a pipeline (option A) involves 
separating two commands with a vertical bar (|). The grep command can 
be used in a pipeline, but it doesn't create one. The command that 
concatenates files (option C) is cat, and the command that displays the last 
several lines of a file (option D) is tail. Several commands, such as find, 
locate, and whereis locate files (option E), but grep is not among them. 
For more information, see Chapter 1. 


10. B, D, E. ReiserFS (option B) was written from scratch for Linux. The 
Third Extended Filesystem (ext3fs; option D) is a journaling filesystem 
based on the older non-journaling Second Extended Filesystem (ext2fs; 
option C). The Extents Filesystem (XFS; option E) is a journaling 


filesystem written by SGI for Irix and later ported to Linux. The Virtual 
File Allocation Table (vfat; option A) is a non-journaling filesystem 
designed by Microsoft for Windows. For more information, see Chapter 3, 
“Configuring Hardware.” 


11. A. Option A correctly describes the features of SSH and GPG in this 
context. Option B is incorrect because SSH should do a fine job of 
encrypting your email so that it can't be decoded between your system and 
your ISP's email server. Option C has it backward; email transferred via 
SSH will be completely encrypted, including both headers and body. GPG 
doesn't encrypt headers, just message bodies. Option D is incorrect because 
GPG isn't a virus scanner, just an encryption tool. Option E is incorrect 
because the SSH tunnel will encrypt everything in the SMTP transfer, 
including email attachments. For more information, see Chapter 10. 


12. A, D. Port 110 (option A) is assigned to the Post Office Protocol (POP), 
and port 143 (option D) is assigned to the Internet Message Access Protocol 
(IMAP), both of which may be used to retrieve email messages from an 
email server system. Port 119 (option B) is assigned to the Network News 
Transfer Protocol (NNTP), port 139 (option C) is assigned to the Server 
Message Block/Common Internet File System (SMB/CIFS) protocol, and 
port 443 (option E) is assigned to the Hypertext Transfer Protocol with SSL 
encryption (HTTPS), none of which is commonly used for email retrieval. 
For more information, see Chapter 8. 


13. C. Log files, such as varlog/messages and sometimes others in varlog, 
often contain useful information concerning server errors. The tail 
program displays the last few lines of a file, so using it to examine log files 
immediately after a problem occurs can be a useful diagnostic procedure. 
Option C correctly combines these features. The http://localhost :631 
URL of option A accesses the Common Unix Printing System (CUPS) 
configuration utility, which has nothing to do with SSH. There is no 
standard diagnose utility (option B) to help diagnose server problems, and 
there is no standard devssh file (option D). The sshd program is the SSH 
server itself, so option E will simply launch the server. For more 
information, see Chapter 5. 


14. B. The ~./profile file is one of several bash startup scripts, as stated in 
option B. It has nothing to do with the ProF TP server (option A) or the tcsh 
shell (option D). The ProFile file manager mentioned in option C is 
fictitious. Users' encrypted passwords (option E) are usually stored in 


etcshadow. For more information, see Chapter 9, “Writing Scripts, 
Configuring Email, and Using Databases.” 


15. E. The at utility was created to run programs at one specified point in the 
future. Thus, option E will accomplish the stated goal. Options A and C 
might also work, but neither is the best way to accomplish this goal. Option 
A will tie up CPU time, and if the program crashes or the system is shut 
down during the intervening two years, the message will never be 
displayed. Option C would be more reliable, but it adds unnecessary 
complexity to your hourly cron job schedule. The cal program displays a 
text-mode calendar, enabling you to identify the days of a week for a given 
month; it doesn't schedule future jobs, as option B suggests. A GUI 
calendar program, as specified in option D, might work, but NTP is the 
Network Time Protocol, a protocol and like-named program for 
synchronizing clocks across a network. Thus, NTP isn't the tool for the job, 
and option D is incorrect. For more information, see Chapter 7. 


16. D. Option D provides the correct command to add 172.24.21.1 as the 
default gateway. Options A and B both use the fictitious gateway 
command, which doesn't exist and therefore won't work unless you create a 
script of this name. Option C uses the correct route command, but there is 
no gateway option to route; you must use add default gw, as in option D. 
There is no standard gw command, so option E is incorrect. For more 
information, see Chapter 8. 


17. B, C. The BRLTTY package is an add-on daemon for handling a Braille 
display device, and some features for using these devices have been added 
to the 2.6.26 kernel, so options B and C are correct. Emacspeak (option A) 
is speech-synthesis software; it can be used to “speak” a text display to a 
user, but it doesn't interface with Braille displays. GOK (option D) is an 
onscreen keyboard, not a Braille display tool. Framebuffer drivers (option 
E) are kernel drivers for managing conventional video cards; they aren't 
used to drive Braille displays. For more information, see Chapter 6. 


18. C. Some dependencies result from dynamically linking binaries to libraries 
at compile time, and so they can be overcome by recompiling the software 
from a source RPM, so option C is correct. Option A describes Debian 
source packages, not RPM packages. Recompiling a source RPM requires 
only issuing an appropriate command, although you must also have 
appropriate compilers and libraries installed. Thus, option B is overly 
pessimistic. Source tarballs can also be used to compile software for RPM 


systems, although this results in none of RPM's advantages. Thus, option D 
is overly restrictive. The RPM format doesn't impose any licensing 
requirements, contrary to option E. For more information, see Chapter 2. 


19. D. The mv utility can be used to rename files as well as move them from 
one location to another, so option D is correct. The dd utility (option A) is 
used to copy files to backups, rm (option B) is used to remove (delete) files, 
cp (option C) copies files, and 1n (option E) creates links. For more 
information, see Chapter 4. 


20. B. Appending an ampersand (&) to a command causes that command to 
execute in the background. The program so launched still consumes CPU 
time, but it won't monopolize the shell you used to launch it. Thus, option B 
is correct. The start (option A) and background (option D) commands are 
fictitious. Although bg (option C) does place a job into the background, it 
doesn't launch a program that way; it places a process that has already been 
suspended (by pressing Ctrl+Z) into the background. The nice utility 
(option E) launches a program with modified priority, but a program so 
launched still monopolizes its shell unless you take additional steps. For 
more information, see Chapter 2. 


21. A, B. The -Uvh parameter (option A) issues an upgrade command (which 
installs the program whether or not an earlier version is installed) and 
creates a series of hash marks to display the command's progress. The -i 
parameter (option B) installs the program if it's not already installed but 
causes no progress display. Option C uses a package name, not a complete 
filename, and so it will fail to install the package file. The -e option (option 
D) removes a package. Option E's -Vp option verifies the package file but 
doesn't install it. For more information, see Chapter 2. 


22. B. Option B, fsck, is Linux's filesystem check utility. It's similar in 
purpose to the DOS and Windows CHKDSK and ScanDisk utilities (similar to 
options C and D), but these DOS and Windows utilities don't work on 
Linux filesystems like ext2fs or ReiserFS. Option A, mkfs, creates new 
filesystems; it doesn't diagnose or fix filesystem problems. Option E, fdisk, 
is a tool for creating or modifying disk partitions; it doesn't manage the 
filesystems they contain. For more information, see Chapter 3. 


23. A. A freshly installed MySQL database is unlikely to have a ready-made 
database of animals, so your first task is to create that database with the 
CREATE DATABASE command, as shown in option A. (You could call the 


database something other than animals, of course.) The USE command in 
option B will be useful only once the database has been created. Once the 
database is created, you can use CREATE TABLE, as in option C, to create a 
table; however, you'll need an existing database first, and this command 
also requires information about the type of data to be stored, which option 
C doesn't provide. Option D's INSERT INTO command stores data into a 
table once it's been created, so it's far from the first command you'll use. It 
also requires additional specification of the data to be stored, so it's 
incomplete. Option E's UPDATE command modifies existing entries, so you'll 
use this command only after you've created the database and added at least 
one animal to it. (Option E is also an incomplete command even then.) For 
more information, see Chapter 9. 


24. B, D. The correct answers, man and info (options B and D), are two 
common Linux help packages. Although ? (option C) is a common help 
command within certain interactive programs, it isn't a help command in 
bash or other common Linux shells. There is no common command called 
manual (option A), nor is hint (option E) a valid bash command or 
common program name. For more information, see Chapter 1. 


25. A, C. Unix systems traditionally store time in UTC (aka Greenwich mean 
time), and Linux may do so as well. Thus, option A is correct. Most other 
x86 PC OSs traditionally store time as the local time, however, so Linux 
also supports this option and option C is also correct. Internet Time (option 
B) is an alternative to the 24-hour clock in which the day is broken into 
1,000 “beats.” Standard PC BIOSs don't support this time format. Likewise, 
a 12-hour clock isn't terribly useful to computers because it doesn't 
differentiate a.m. from p.m., making option D incorrect. Although the 
length of the Martian day is similar to that of Earth (24 hours and 37 
minutes), those wanting to colonize Mars will have to wait for PC clocks to 
support setting time for the Red Planet; option E is incorrect. For more 
information, see Chapter 7. 


26. D. Typing 1smod (option D) produces a list of the modules that are 
currently loaded. The insmod (option A) and modprobe (option C) programs 
both load modules—either a single module or a single module and all those 
on which it depends, respectively. The depmod command (option B) 
generates the modules . dep file that contains module dependency 
information. The modinfo command (option E) displays information, such 
as its version number and author, on a single module. For more 


information, see Chapter 3. 


27. B, E. The chgrp and chown commands can both change the group 
ownership of a file. The chgrp command takes a group name and a 
filename as parameters, as in option B. The chown command normally 
changes a file's owner; but if you provide a group name preceded by a dot 
(.) or a colon (:), as in option E, it changes the group of a file. The chown 
command as used in option A, will change the primary ownership of the file 
to the music user, if such a user exists on the system; it won't change the 
group ownership. There is no standard chgroup command, as in option C. 
Option D will change the permissions to 0600 (- rw- - - - - - - ), which will be 
a step backward with respect to the goal stated. For more information, see 


Chapter 4. 


28. E. Hard links to directories are not permitted by most filesystems, so you'll 
probably have to create a symbolic link, as noted in option E. Links don't 
rely on a filesystem journal, so option A is incorrect. Contrary to option B, 
anybody may create a link, not just the original's owner. Option C describes 
a restriction of hard links, but because this link will probably have to be a 
symbolic link, this restriction is unimportant and option C is incorrect. 
Option D describes a more severe restriction than option B, but it's incorrect 
for the same reasons. For more information, see Chapter 4. 


29. B, E. The colon (:) starts ex mode, from which you can enter commands. 
In ex mode, r includes a file in an existing one, w writes a file, e loads an 
entirely new file, and q quits the program. Thus the desired combination is 
:wq (option B). As a special case, ZZ does the same thing, so option E is 
also correct. For more information, see Chapter 5. 


30. C. The ~/. forward file is a user email forwarding file. The vertical bar 
character (|) at the start of such a file is a code to send the email through 
the specified program file, so option C is correct. To do as option A 
describes, the file would need to read junkme or junkme@hostname, where 
hostname is the computer's hostname. To do as option B describes, the 
leading vertical bar would have to be omitted. It's conceivable that the 
~/junkme script does as option D describes, but there's no way of knowing 
this for certain. To do as option E describes, the file would have to read 
user@junkme, where user is the username. For more information, see 


Chapter 9. 
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Exam LX0-103 


Chapter 1 
Exploring Linux Command-Line Tools 


THE FOLLOWING EXAM OBJECTIVES ARE COVERED IN THIS 
CHAPTER: 


Y 103.1 Work on the command line 
Y 103.2 Process text streams using filters 
Y 103.4 Use streams, pipes, and redirects 


Y 103.7 Search text files using regular expressions 


Linux borrows heavily from Unix, and Unix began as a text-based operating 
system (OS). Unix and Linux retain much of this heritage, which means to 
understand how to use and, especially administer Linux, you must understand at 
least the basics of its command-line tools. Using command-line tools requires 
the use of a shell. A shell is a program that accepts and interprets text-mode 
commands and provides an interface to the system. 


This chapter begins with basic shell information, including the various shell 
programs available and the procedures for using them. From there, this chapter 
covers streams, pipes, and redirection, which you can use to move input and 
output between programs or between files and programs. These techniques are 
frequently combined with text processing using filters—commands you can use 
to manipulate text without the help of a conventional text editor. Sometimes you 
must manipulate text in an abstract way, using codes to represent several 
different types of text. This chapter, therefore, covers this topic as well. 


Understanding Command-Line Basics 


Before you do anything else with Linux, you should understand how to use a 
Linux shell. The shell allows you to enter commands as needed. Which 
commands can be entered depends on which shell program is running. Several of 
the available shell programs are briefly described. 


In using shell commands, you should also understand shell environment 
variables, which are placeholders for data that may be useful to many programs. 
Finally, it is helpful to know how to get help with the shell commands you're 
trying to use. 


Exploring Your Linux Shell Options 


The shell to be used for entering commands is configured for each individual 
user, and Linux provides a range of available shells. A complete shell list would 
be quite long, but the following shells are among the more common choices: 


bash The GNU Bourne Again Shell (bash) is based on the earlier Bourne 
shell for Unix but extends it in several ways. In Linux, bash is the most 
common default shell for user accounts, and it's the one emphasized in this 
book and on the exam. 


ShThe Bourne shell upon which bash is based goes by the name sh. It's not 
often used in Linux and the sh command is often a pointer to the bash shell 
or other shells. 


tcsh This shell is based on the earlier C shell (csh). It's a fairly popular 
shell in some circles, but no major Linux distributions make it the default 
shell. Although it's similar to bash in many respects, some operational 
details differ. For instance, you don't assign environment variables the same 
way in tcsh as in bash. 


csh The original C shell isn't used much on Linux, but if a user is familiar 
with csh, tcsh makes a good substitute. 


ksh The Korn shell (ksh) was designed to take the best features of the 
Bourne shell and the C shell and extend them. It has a small but dedicated 
following among Linux users. 


zsh The Z shell (zsh) takes shell evolution further than the Korn shell, 
incorporating features from earlier shells and adding still more. 


In addition to these shells, dozens more obscure ones are available. In Linux, 
most users run bash because it is the most popular shell. Some other OSs use 
csh or tcsh as the default, so if your users have backgrounds on non-Linux 
Unix-like OSs, they may be more familiar with these other shells. You can 
change a user's default shell by editing their account, as described in Chapter 7, 
“Administering the System.” 


Be aware that there are two types of default shells. The default interactive shell 
is the shell program a user uses to enter commands, run programs from the 
command line, run shell scripts, and so on. The other default shell type is a 
default system shell. The default system shell is used by the Linux system to run 
system shell scripts, typically at startup. 


The file binsh is a pointer to the system's default system shell—normally 
binbash for Linux. However, be aware that, on some distributions, the binsh 
points to a different shell. For example, on Ubuntu, binsh points to the dash 
shell, bindash. 


Using a Shell 


Linux shell use is fairly straightforward for anybody who's used a text-mode OS 
before: You type a command, possibly including options to it, and the computer 
executes the command. For the most part, Linux commands are external—that 
is, they're programs that are separate from the shell. 


A few commands are internal to the shell, though, and knowing the distinction 
can be important. You should also know some of the tricks that can make using 
the command shell easier—how to have the computer complete a long command 
or filename, retrieve a command you've recently run, or edit a command you've 
recently used (or haven't yet fully entered). 


Starting a Shell 


If you log into Linux using a text-mode login screen, you have logged into a 
virtual console terminal and, most likely, you'll be dropped directly into your 
default shell. The shell program is what presents the prompt and accepts 
subsequent commands. 


If you log into Linux using a graphical user interface (GUI) login screen, you'll 
have to start a terminal emulator manually in order to reach your default shell. 
Some GUIs provide a menu option, such as xterm or terminal, to start a 
terminal emulator program. These programs enable you to run text-mode 


programs within Linux, and by default they come up running your shell. If you 
can't find such a menu option, look for a menu option that enables you to run an 
arbitrary command. Select it, and type xterm or konsole as the command name. 
This will launch a terminal emulator program that will run a shell. 


Once you start a terminal or log into a virtual console terminal, the shell will 
provide you with a prompt for entering commands. Remember that the shell is a 
program providing you with an interface to the Linux system. 


A good first command to try, uname, will show what operating system is being 
run: 


$ uname 
Linux 
$ 


That's not too interesting. You can find out additional information by tacking on 
the -a option to the command. Be sure to include the necessary space between 
the command and the option: 


$ uname -a 

Linux server@1.class.com 2.6.32-431.5.1.e16.x86_64 #1 SMP Wed Feb 
12 

00:41:43 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux 

$ 


The uname -a command provides a lot more information, including the current 
Linux kernel being used (2.6.32) as well as the system's hostname 
(server@1.class.com). The uname command is an external command. The shell 
also provides internal commands. It's important to know the difference between 
the two command types, as explained in the next section. 


Using Internal and External Commands 


Internal commands are, as you might expect, built into the shell program. Thus 
they are also called built-in commands. Most shells offer a similar set of internal 
commands, but shell-to-shell differences do exist. Internal commands that you're 
likely to use enable you to perform some common tasks: 


Change the Working Directory 


Whenever you're running a shell, you're working in a specific directory. 
The cd command changes the current working directory. For instance, 
typing cd homesally changes the current working directory to the 


homesally directory. 


You can use shortcut characters with the cd command as well. The tilde 
(~) character is a useful shortcut; it stands for your home directory. Thus 
typing cd ~ will have the same effect as typing cd homesally if your 
home directory is homesally. 


Display the Working Directory 


The pwd command displays (“prints” to the screen) the current working 
directory. This command is helpful, especially after you have changed your 
working directory, to ensure you ended up in the right place. 


Display a Line of Text 


The echo command displays the text you enter. For instance, typing echo 
Hello causes the system to display the string Hello. This may seem 
pointless, but it's useful in scripts (described in Chapter 9, “Writing Scripts, 
Configuring Email, and Using Databases”), and it can also be a good way 
to review the contents of environment variables (described later in this 
chapter, in the section “Using Environment Variables”). 


Time an Operation 


The time command times how long subsequent commands take to execute. 
For instance, typing time pwd tells you how long the system took to 
execute the pwd command. The time is displayed after the full command 
terminates. Three times are displayed: total execution time (aka real time), 
user CPU time, and system CPU time. The final two values tell you about 
CPU time consumed, which is likely to be much less than the total 
execution time. 


Set Options 


In its most basic form, the set command displays a wide variety of options 
relating to bash shell operation. These options are formatted much like 
environment variables, but they aren't the same things. You can pass 
various options to set to have it affect a wide range of shell operations. 


Terminate the Shell 


The exit and logout commands both terminate the shell. The exit 
command terminates any shell, but the logout command terminates only 
login shells. Login shells are shell programs that are launched automatically 
when you initiate a text-mode login as opposed to those that run in xterm 


windows or other terminal emulators. 


pom 


The preceding list isn't complete. Later sections of this chapter and later 
chapters describe some additional internal commands. Consult your shell's 
documentation for a complete list of its internal commands. 


You can quickly determine if a command is a builtin command by using the 
type command. Just enter the command type before the name of the command 
you wish to check: 


$ type pwd 

pwd is a shell builtin 
$ 

$ type cd 

cd is a shell builtin 
$ 

$ type bash 

bash is binbash 

$ 


Some of these internal commands are duplicated by external commands that do 
the same thing. But those external commands aren't always installed on all 
systems. You can see if there are internal commands with installed duplicate 
external commands by using the -a option on the type command: 


$ type -a cd 
cd is a shell builtin 
$ 


$ type -a pwd 

pwd is a shell builtin 
pwd is binpwd 

$ 


You can see that on this system, there is no external cd command installed. 
However, it does have an external pwd command installed. 


Keep in mind that even when external commands are installed, the internal 
command takes precedence. To access the external command, you must provide 
the complete external command path, as in typing /usrbintime rather than time. 
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Confusion over Internal and External 
Commands 


When duplicate internal and external commands exist, they sometimes 
produce subtly different results or accept different options. These differences 
may occasionally cause problems if you are unaware of them. For example, 
the time built-in command returns slightly different results than the 


usrbin/time external command: $ time pwd homeChristine real 
Om0.002s user OmO.002s sys Om0.001s $ $ usrbin/time pwd 
homeChristine ©.0Quser ©.00system 0:00.04elapsed 24%CPU 
(Oavgtext+Oavgdata 2336maxresident)k 56inputs+Ooutputs 
(1major+173minor)pagefaults Oswaps $ 


As you Can see, bash's internal time shows the time to execute the pwd 
command in a very nice format, while the external time command 
usrbin/time is not only a little sloppy in appearance, it also provides 
additional details. Be mindful of the potential behavior differences between 
internal and external commands. 





When you type a command that's not recognized by the shell as one of its 
internal commands, the shell checks its path to find a program by that name to 
execute it. The path is a list of directories in which commands can be found. It's 
defined by the $PATH environment variable, as described shortly in “Using 
Environment Variables.” A typical user account has about half a dozen or so 
directories in its path. You can add and remove directories to the shell's path by 
changing the $PATH environment variable in a shell configuration file, as 
described in “Exploring Shell Configuration” later in this chapter. 


You can run programs that aren't on the path by providing a complete path name 
on the command line. For instance, typing ./myprog runs the myprog program in 
the current directory. Typing homearthur/thisprog runs the thisprog program 
in the homearthur directory. 
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The root account should normally have a shorter path than ordinary user 
accounts. Typically, you'll omit directories that store GUI and other user- 
oriented programs from root's path in order to discourage use of the root 
account for routine operations. This minimizes the risk of security breaches 
related to buggy or compromised binaries being run by root. Most 
important, root's path should never include the current directory (./). 
Placing this directory in root's path makes it possible for a local 
troublemaker to trick root into running replacements for common programs. 
Omitting the current directory from ordinary user paths is also generally a 
good idea. If this directory must be part of the ordinary user path, it should 
appear at the end of the path so that the standard programs take precedence 
over any replacement programs in the current directory. 


Whether you need to enter the path or not for a command, the program file must 
be marked as executable. This is done via the execute bit that's stored with the 
file. Standard programs are marked as executable when they're installed, but if 
you need to adjust a program's executable status, you can do so with the chmod 
command, as described in Chapter 4, “Managing Files.” 


Performing Some Shell Command Tricks 


Many users find typing commands to be tedious and error-prone. This is 
particularly true of slow or sloppy typists. For this reason, Linux shells include 
various tools that can help speed up operations. The first of these is command 
completion: Type part of a command or a filename (as an option to the 
command), and then press the Tab key. The shell tries to fill in the rest of the 
command or the filename. If just one command or filename matches the 
characters you've typed so far, the shell fills the rest of the command (or 
filename) for you and adds a space after it. 


If the characters you've typed don't uniquely identify a command (or filename), 
the shell fills in what it can and then stops. Depending on the shell and its 
configuration, it may beep. If you press the Tab key again, the system responds 
by displaying the possible completions. You can then type another character or 
two and, if you haven't completed the command (or filename), press the Tab key 


again to have the process repeat. 


The most fundamental Linux commands have fairly short names—nmv, 1s, set, 
and so on. However, some other commands are much longer, such as 
traceroute or service --status-all. Filenames can also be quite lengthy— 
up to 255 characters on many filesystems. Thus command completion can save a 
lot of time when you're typing. It can also help you avoid typos. 
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The most popular Linux shells, including bash and tcsh, support command 


and filename completion. Some older shells, though, don't support this 
helpful feature. 


Another useful shell shortcut is history. The shell history keeps a record of every 
command you type. If you've typed a long command recently and want to use it 
again or use a minor variant of it, you can pull the command out of the history. 


There are several rather easy methods to retrieve commands. It comes down to 
determining the method you like best: 


Retrieve a Command 


The simplest way to do this is to press the Up arrow key on your keyboard; 
this brings up the previous command. Pressing the Up arrow key repeatedly 
moves through multiple commands so you can find the one you want. If 
you overshoot, press the Down arrow key to move down the history. The 
Ctrl+P and Ctrl+N keystrokes double for the Up and Down arrow keys, 
respectively. 


Search for a Command 


Press Ctrl+R to begin a backward (reverse) search, and begin typing 
characters that should be unique to the command you want to find. The 
characters you type need not be the ones that begin the command; they can 
exist anywhere in the command. You can either keep typing until you find 
the correct command or, after you've typed a few characters, press Ctrl+R 
repeatedly until you find the one you want. 


The Ctrl+S keystroke is used to search forward in the command history. 
You can press the Ctrl+S keystroke while using the backward search. This 
reverses the history search from backward to forward. If you used a 
backward search and have passed by what you need, then this keystroke is 
useful. 
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If the Ctrl+S keystroke causes your terminal to hang, press Ctrl+Q to 
resume terminal operations. To keep your terminal from hanging when 
Ctrl+S is used, type stty -ixon at the command line. 


In either event, if you can't find the command you want or if you change 
your mind and want to terminate the search, press Ctrl+G to do so. 


Frequently, after finding a command in the history, you want to edit it. The bash 
shell, like many shells, provides editing features modeled after those of the 
Emacs editor: 


Move within the Line 


Press Ctrl+A or Ctrl+E to move the cursor to the start or end of the line, 
respectively. The Left and Right arrow keys move within the line a 
character at a time. Ctrl+B and Ctrl+F do the same, moving backward and 
forward within a line. Pressing Ctrl plus the Left or Right arrow key moves 
backward or forward a word at a time, as does pressing Esc and then B or F. 


Delete Text 


Pressing Ctrl+D or the Delete key deletes the character under the cursor. 
Pressing the Backspace key deletes the character to the left of the cursor. 
Pressing Ctrl+K deletes all text from the cursor to the end of the line. 
Pressing Ctrl+X and then Backspace deletes all of the text from the cursor 
to the beginning of the line. 


Transpose Text 


Pressing Ctrl+T transposes the character before the cursor with the 
character under the cursor. Pressing Esc and then T transposes the two 
words immediately before (or under) the cursor. 


Change Case 


Pressing Esc and then U converts text from the cursor to the end of the 
word to uppercase. Pressing Esc and then L converts text from the cursor to 
the end of the word to lowercase. Pressing Esc and then C converts the 


Tat anss semdinn thin Assen Faw thin fiunt lattan nf thn Asch een j brn. ssn nmin 


Jetler ullger ule CULSOF (OF WE List Letler OL Le LWeXt WOLU) LO Uppercdse, 
leaving the rest of the word unaffected. 


Invoke an Editor 


You can launch a full-fledged editor to edit a command by pressing Ctrl+X 
followed by Ctrl+E. The bash shell attempts to launch the editor defined by 
the $FCEDIT or $EDITOR environment variable, or it launches Emacs as a 
last resort. 


These editing commands are just the most useful ones supported by bash. In 
practice, you're likely to make heavy use of command and filename completion, 
the command history, and perhaps a few editing features. 
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If you prefer the vi editor to Emacs, you can use a vi-like mode in bash by 
typing set -o vi. (vi is described in Chapter 5, “Booting Linux and Editing 
Files.”) 


The history command provides an interface to view and manage the history. 
Typing history alone displays all of the commands in the history (typically the 
latest 500 commands). 


To retrieve the last command in your shell history, type !! and press Enter. This 
will not only show you the command you recalled but execute it as well: 


$ !! 

type -a pwd 

pwd is a shell builtin 
pwd is binpwd 

$ 


You can execute a command by number via typing an exclamation mark 
followed by its number, as in !210 to execute command 210. Typing history - 
c clears the history, which can be handy if you've recently typed commands 
you'd rather not have discovered by others, such as commands that include 
passwords. 


The bash history is stored in the .bash_history file in your home directory. 
This is an ordinary plain-text file, so you can view it with a text editor or a 
command such as less (described later, in “Paging through Files with less”). 
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Because your bash history is stored in a file, it can be examined by anybody 
who can read that file. Some commands enable you to type passwords or 
other sensitive data on the same line as the commands themselves, which 
can therefore be risky. The ~/.bash_history file does not record what you 
type in response to other programs' prompts, just what you type at the bash 
prompt itself. Thus, if you have a choice, you should let commands that 
require passwords (or other sensitive data) prompt you to enter this data 
rather than enter such information as options to the command at the bash 
prompt. 


In Exercise 1.1, you'll experiment with your shell's completion and command- 
editing tools. 


Exercise 1.1 
Editing Commands 


To experiment with your shell's completion and command-editing tools, 
follow these steps: 
1. Log in as an ordinary user. 


2. Create a temporary directory by typing mkdir test. (Directory and file 
manipulation commands are described in more detail in Chapter 4.) 


3. Change into the test directory by typing cd test. 


4. Create a few temporary files by typing touch one two three. This 
command creates three empty files named one, two, and three. 


5. Type 1s -1 t and, without pressing the Enter key, press the Tab key. 
The system may beep at you or display two three. If it doesn't display 
two three, press the Tab key again and it should do so. This reveals 
that either two or three is a valid completion to your command, 
because these are the two files in the test directory whose filenames 
begin with the letter t. 





6. Type h, and again without pressing the Enter key, press the Tab key. 
The system should complete the command (1s -1 three), at which 
point you can press the Enter key to execute it. (You'll see information 
on the file.) 


7. Press the Up arrow key. You should see the 1s -1 three command 
appear on the command line. 


8. Press Ctrl+A to move the cursor to the beginning of the line. 


9. Press the Right arrow key once, and type es (without pressing the Enter 
key). The command line should now read less -1 three. 


10. Press the Right arrow key once, and press the Delete key three times. 
The command should now read less three. Press the Enter key to 
execute the command. (Note that you can do so even though the cursor 
isn't at the end of the line.) This invokes the less pager on the three 
file. (The less pager is described more fully later in “Paging through 
Files with less.”) Because this file is empty, you'll see a mostly empty 
screen. 


11. Press the Q key to exit from the less pager. 





Exploring Shell Configuration 


Shells, like many Linux programs, are configured through files that hold 
configuration options in a plain-text format. The bash configuration files are 
actually bash shell scripts, which are described more fully in Chapter 9. A 
couple of examples of these configuration files are ~/.bashrc and etcprofile. 


Even without knowing much about shell scripting, you can make simple changes 
to these files. Edit them in your favorite text editor, and change whatever needs 
changing. For instance, you can add directories to the $PATH environment 
variable, which takes a colon-delimited list of directories. 
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Be careful when changing your bash configuration files, particularly the 
global bash configuration files. Save a backup of the original file before 
making changes, and test your changes immediately by logging in using 


another virtual terminal. If you spot a problem, revert to your saved copy 
until you determine the problem's causes and create a working file. 


Using Environment Variables 


Environment variables are like variables in programming languages—they hold 
data to be referred to by the variable name. Environment variables differ from 
programs' internal variables in that they're part of the program's environment, 
and other programs, such as the shell, can modify this environment. Programs 
can rely on environment variables to set information that can apply to many 
different programs. For instance, many text-based programs need to know the 
capabilities of the terminal program you use. This information is conveyed in the 
$TERM environment variable, which is likely to hold a value such as xterm or 
linux. Programs that need to position the cursor, display color text, or perform 
other tasks that depend on terminal-specific capabilities can customize their 
output based on this information. 


Chapter 9 describes environment variables and their manipulation in more detail. 
For the moment, you should know that you can set them in bash by using an 
assignment (=) operator followed by the export command. A fun environment 
variable to change is the $Ps1 variable. It modifies your shell prompt: 


$ 

$ PS1="My New Prompt: " 
My New Prompt: export PS1 
My New Prompt: 


You can combine these two commands into a single form: 


My New Prompt: export PS1="Prompt: " 
Prompt: 
Prompt: 


Either method sets the $PS1 environment variable to a new setting. When setting 
an environment variable, you omit the dollar sign, but subsequent references 
include a dollar sign to identify the environment variable as such. Thereafter, 
programs that need this information can refer to the environment variable. In 
fact, you can do so from the shell yourself using the echo command: 


$ Prompt: echo $PS1 
Prompt: 


An echo of the $PS1 variable value can be a little confusing because it just shows 
your current prompt setting. However, you can get a better feel for displaying an 
environment variable by viewing the $PATH variable using echo: 


Prompt: echo $PATH 
usrlib64/qt-3.3/bin:usrlocal/bin:/bin:usrbin: 
usrlocal/sbin:usrsbin:/sbin:/home/Christine/bin 
Prompt: 


That's a little better. Remember, the $PATH environment variable provides the 
shell with a directory list to search when you're entering command or program 
names. 
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Some environment variables, including the $PATH environment variable, are 
set automatically when you log in via the shell configuration files. If a 
program uses environment variables, its documentation should say so. 


You can also view the entire environment by typing env. The result is likely to 
be several dozen lines of environment variables and their values. Chapter 9 
describes what many of these variables are in more detail. 


To delete an environment variable, use the unset command. The command takes 
the name of an environment variable (without the leading $ symbol) as an 
option. For instance, unset PS1 removes the $PS1 environment variable. But if 
you do this, you will have no shell prompt! 


Getting Help 


Linux provides a text-based help system known as man. This command's name is 
short for manual, and its entries (its man pages) provide succinct summaries of 
what a command, file, or other feature does. For instance, to learn about man 
itself, you can type man man. The result is a description of the man command. 


To peruse the manual pages for a particular command or topic, you type man 
followed by the command or topic as an option. For example, to read about the 
export command, you would type man export at the prompt. If you wanted to 
learn more about the shell builtin (internal) commands, you would type man 
builtin at the prompt. 


The man utility uses the less pager by default to display information. This 
program displays text a page at a time. Press the spacebar to move forward a 
page, Esc followed by V to move back a page, the arrow keys to move up or 
down a line at a time, the slash (/) key to search for text, and so on. (Type man 
less to learn all the details, or consult the upcoming section “Paging through 
Files with less.”) When you're done, press Q to exit less and the man page it's 
displaying. 


You aren't stuck using the less pager with the man utility. You can change the 
pager by using the -P option. For example, if you decided to use the more pager 


instead to look up information on the uname command, you would type man -P 
binmore uname at the shell prompt. 


Occasionally, the problem arises where you can't remember the exact name of a 
command to look up. The man utility has an option to help you here. You can use 
the -k option along with a keyword or two to search through the man pages: 


$ man -k "system information" 
dumpe2fs (8) - dump ext2/ext3/ext4 filesystem information 


[... ] 
uname (1) - print system information 
$ 


The returned information (shown as a partial listing above) can give you some 
clues as to your desired command name. Be aware that poor keyword choices 
may not produce the results you seek. 
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On some older Linux distributions, you may get no results from a man utility 
keyword search. This is most likely due to a missing whatis database. The 
whatis database contains a short description of each man page, and it is 
necessary for keyword searches. To create it or update it, type makewhatis at 


the prompt. You will need to do this as superuser, and it may take several 
minutes to run. 


Linux man pages are organized into several sections, which are summarized in 
Table 1.1. Sometimes a single keyword has entries in multiple sections. For 
instance, passwd has entries under both section 1 and section 5. In most cases, 
man returns the entry in the lowest-numbered section, but you can force the issue 
by preceding the keyword by the section number. For instance, typing man 5 
passwd returns information on the passwd file format rather than the passwd 
command. 


Table 1.1 Manual sections 


Section Description 
number 


Executable programs and shell commands 
System calls provided by the kernel 
Library calls provided by program libraries 
Device files (usually stored in /dev) 

File formats 

Games 


Miscellaneous (macro packages, conventions, and so on) 
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System administration commands (programs run mostly or 
exclusively by root) 


9 Kernel routines 


Some programs have moved away from man pages to info pages. The basic 
purpose of info pages is the same as that for man pages. However, info pages 
use a hypertext format so that you can move from section to section of the 
documentation for a program. Type info info to learn more about this system. 


There are also pages specifically for the built-in (internal) commands called the 
help pages. To read the help pages for a particular built-in command, type help 
command. For instance, to get help on the pwd command, type help pwd at the 
shell prompt. To learn more about how to use the help pages, type help help at 
the shell prompt. 


The man pages, info pages, and help pages are usually written in a terse style. 
They're intended as reference tools, not tutorials! They frequently assume basic 
familiarity with the command, or at least with Linux in general. For more 
tutorial information, you must look elsewhere, such in books or on the Web. 


Using Streams, Redirection, and Pipes 


Streams, redirection, and pipes are some of the more powerful command-line 
tools in Linux. Linux treats the input to and output from programs as a stream, 
which is a data entity that can be manipulated. Ordinarily, input comes from the 
keyboard and output goes to the screen. You can redirect these input and output 
streams to come from or go to other sources, such as files. Similarly, you can 
pipe the output of one program as input into another program. These facilities 
can be great tools to tie together multiple programs. 
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Part of the Unix philosophy to which Linux adheres is, whenever possible, to 
do complex things by combining multiple simple tools. Redirection and 
pipes help in this task by enabling simple programs to be combined together 
in chains, each link feeding off the output of the preceding link. 


Exploring File Descriptors 


To begin understanding redirection and pipes, you must first understand the 
different file descriptors. Linux handles all objects as files. This includes a 
program's input and output stream. To identify a particular file object, Linux 
uses file descriptors: 


Standard Input 


Programs accept keyboard input via standard input, abbreviated STDIN. 
Standard input's file descriptor is © (zero). In most cases, this is the data that 
comes into the computer from a keyboard. 


Standard Output 


Text-mode programs send most data to their users via standard output, 
abbreviated STDOUT. Standard output is normally displayed on the screen, 
either in a full-screen text-mode session or in a GUI terminal emulator, 
such as an xterm. Standard output's file descriptor is 1 (one). 


Standard Error 


Linux provides a second type of output stream, known as standard error, 
abbreviated STDERR. Standard error's file descriptor is 2 (two). This 
output stream is intended to carry high-priority information such as error 
messages. Ordinarily, standard error is sent to the same output device as 
standard output, so you can't easily tell them apart. You can redirect one 
independently of the other, though, which can be handy. For instance, you 
can redirect standard error to a file while leaving standard output going to 
the screen. This allows you to view the error messages at a later time. 


Internally, programs treat STDIN, STDOUT, and STDERR just like data files— 


they open them, read from or write to the files, and close them when they're 
done. This is why the file descriptors are necessary and why they can be used in 
redirection. 


Redirecting Input and Output 


To redirect input or output, you use operators following the command, including 
any options it takes. For instance, to redirect the STDOUT of the echo 
command, you would type something like this: 


$ echo $PATH 1> path.txt 

$ 

$ cat path.txt 
usrl1ib64/qt-3.3/bin:usrlocal/bin:/bin:usrbin: 
usrlocal/sbin:usrsbin:/sbin:/home/Christine/bin 
$ 


The result is that the file path. txt contains the output of the command (in this 
case, the value of the $PATH environment variable). The operator used to perform 
this redirection was > and the file descriptor used to redirect STDOUT was 1 
(one). 
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The cat command allows you to display a file's contents to STDOUT. It is 
described further in the section “Processing Text Using Filters” later in this 
chapter. 


A nice feature of redirecting STDOUT is that you do not have to use its file 
descriptor, only the operator. Here's an example of leaving out the 1 (one) file 
descriptor, when redirecting STDOUT: 


$ echo $PATH > another_path.txt 
$ 


$ cat another_path.txt 
usr1ib64/qt-3.3/bin:usrlocal/bin:/bin:usrbin: 


usrlocal/sbin:usrsbin:/sbin:/home/Christine/bin 


$ 
You can see that even without the STDOUT file descriptor, the output was 
redirected to a file. However, the redirection operator (>) was still needed. 


You can also leave out the STDIN file descriptor when using the appropriate 
redirection operator. Redirection operators exist to achieve several effects, as 
summarized in Table 1.2. 


Table 1.2 Common redirection operators 


Redirection Effect 
operator 


> Creates a new file containing standard output. If the specified file 
exists, it's overwritten. No file descriptor necessary. 


>> 


2> 


2>> 


&> 


<< 


<> 


Appends standard output to the existing file. If the specified file 
doesn't exist, it's created. No file descriptor necessary. 


Creates a new file containing standard error. If the specified file 
exists, it's overwritten. File descriptor necessary. 


Appends standard error to the existing file. If the specified file 
doesn't exist, it's created. File descriptor necessary. 


Creates a new file containing both standard output and standard 
error. If the specified file exists, it's overwritten. No file 
descriptors necessary. 


Sends the contents of the specified file to be used as standard 
input. No file descriptor necessary. 


Accepts text on the following lines as standard input. No file 
descriptor necessary. 


Causes the specified file to be used for both standard input and 
standard output. No file descriptor necessary. 


Most of these redirectors deal with output, both because there are two types of 
output (standard output and standard error) and because you must be concerned 
with what to do in case you specify a file that already exists. The most important 
input redirector is <, which takes the specified file's contents as standard input. 
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A common trick is to redirect standard output or standard error to devnull. 
This file is a device that's connected to nothing; it's used when you want to 
get rid of data. For instance, if the whine program is generating too many 
unimportant error messages, you can type whine 2> devnull to run it and 
discard its error messages. 


One redirection operator that requires elaboration is the << operator. This 
operator implements something called a here document. A here document takes 
text from subsequent lines as standard input. Chances are you won't use this 
redirector on the command line. Subsequent lines are standard input, so there's 
no need to redirect them. Rather, you might use this command in a script to pass 
data to an interactive program. Unlike with most redirection operators, the text 
immediately following the << code isn't a filename; instead, it's a word that's 
used to mark the end of input. For instance, typing someprog << EOF causes 
someprog to accept input until it sees a line that contains only the string EOF 
(without even a space following it). 
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Some programs that take input from the command line expect you to 
terminate input by pressing Ctrl+D. This keystroke corresponds to an end- 


of-file marker using the American Standard Code for Information 
Interchange (ASCII). 


Piping Data between Programs 


Programs can frequently operate on other programs' outputs. For instance, you 
might use a text-filtering command (such as the ones described shortly in 
“Processing Text Using Filters”) to manipulate text output by another program. 
You can do this with the help of redirection operators: send the first program's 
standard output to a file, and then redirect the second program's standard input to 
read from that file. This method is awkward, though, and it involves the creation 
of a file that you might easily overlook, leading to unnecessary clutter on your 
system. 


The solution is to use data pipes (aka pipelines). A pipe redirects the first 
program's standard output to the second program's standard input, and it is 
denoted by a vertical bar (|): 


$ first | second 


For instance, suppose that first generates some system statistics, such as 
system uptime, CPU use, number of users logged in, and so on. This output 
might be lengthy, so you want to trim it a bit. You might therefore use second, 
which could be a script or command that echoes from its standard input only the 
information in which youre interested. (The grep command, described in “Using 
grep,” is often used in this role.) 


Pipes can be used in sequences of arbitrary length: 


$ first | second | third | fourth | fifth | sixth [..] 


Another redirection tool often used with pipes is the tee command. This 
command splits standard input so that it's displayed on standard output and in as 


many files as you specify. Typically, tee is used in conjunction with data pipes 
so that a program's output can be both stored and viewed immediately. For 
instance, to view and store the output of the echo $PATH command, you might 
type this: 


$ echo $PATH | tee path.txt 
usrl1ib64/qt-3.3/bin:usrlocal/bin:/bin:usrbin: 
usrlocal/sbin:usrsbin:/sbin:/home/Christine/bin 
$ 

$ cat path.txt 
usrlib64/qt-3.3/bin:usrlocal/bin:/bin:usrbin: 
usrlocal/sbin:usrsbin:/sbin:/home/Christine/bin 
$ 


Notice that not only were the results of the command displayed to STDOUT, but 
they were also redirected to the path. txt file by the tee command. Ordinarily, 
tee overwrites any files whose names you specify. If you want to append data to 
these files, pass the -a option to tee. 


Generating Command Lines 


Sometimes you'll find yourself needing to conduct an unusual operation on your 
Linux server. For instance, suppose you want to remove every file in a directory 
tree that belongs to a certain user. With a large directory tree, this task can be 
daunting! 


The usual file-deletion command, rm (described in more detail in Chapter 4), 
doesn't provide an option to search for and delete every file that matches a 
specific criterion. One command that can do the search portion is find (also 
described in more detail in Chapter 4). This command displays all of the files 
that match the criteria you provide. If you could combine the output of find to 
create a series of command lines using rm, the task would be solved. This is 
precisely the purpose of the xargs command. 


The xargs command builds a command from its standard input. The basic 
syntax for this command is as follows: 


xargs [options] [command [initial-arguments] ] 


The command is the command you want to execute, and initial-arguments is a 
list of arguments you want to pass to the command. The options are xargs 
options; they aren't passed to command. When you run xargs, it runs command 
once for every word passed to it on standard input, adding that word to the 


argument list for command. If you want to pass multiple options to the command, 
you can protect them by enclosing the group in quotation marks. 


For instance, consider the task of deleting several files that belong to a particular 
user. You can do this by piping the output of find to xargs, which then calls rm: 


# find / -user Christine | xargs -d "\n" rm 


The first part of this command (find / -user Christine) finds all of the files 
in directory tree (/) and its subdirectories that belong to user Christine. (Since 
you are looking through the entire directory tree, you need superuser privileges 
for this to work properly.) This list is then piped to xargs, which adds each input 
value to its own rm command. Problems can arise if filenames contain spaces 
because by default xargs uses both spaces and newlines as item delimiters. The 
-d ”\n” option tells xargs to use only newlines as delimiters, thus avoiding this 
problem in this context. (The find command separates each found filename with 
a newline.) 
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It is important to exercise caution when using the rm command with 
superuser privileges. This is especially true when piping the files to delete 


into the rm command. You could easily delete the wrong files 
unintentionally. 


A tool that's similar to xargs in many ways is the backtick (`), which is a 
character to the left of the 1 key on most keyboards. The backtick is not the same 
as the single quote character ('), which is located to the right of the semicolon 
(;) on most keyboards. 


Text within backticks is treated as a separate command whose results are 
substituted on the command line. For instance, to delete those user files, you can 
type the following command: 


# rm `find ./ -user Christine` 


The backtick solution works fine in some cases, but it breaks down in more 
complex situations. The reason is that the output of the backtick-contained 
command is passed to the command it precedes as if it had been typed at the 
shell. By contrast, when you use xargs, it runs the command you specify (rm in 
these examples) once for each of the input items. What's more, you can't pass 
options such as -d ”\n” to a backtick. Thus these two examples will work the 
same in many cases, but not in all of them. 
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Use of the backtick is falling out of favor because backticks are so often 
confused with single quotation marks. In several shells, you can use $( ) 
instead. For instance, the backtick example used in the preceding example 
would be changed to # rm $(find ./ -user Christine) 


This command works just as well, and it is much easier to read and 
understand. 


Processing Text Using Filters 


In keeping with Linux's philosophy of providing small tools that can be tied 
together via pipes and redirection to accomplish more complex tasks, many 
simple commands to manipulate text are available. These commands accomplish 
tasks of various types, such as combining files, transforming the data in files, 
formatting text, displaying text, and summarizing data. 
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Many of the following descriptions include input-file specifications. In most 
cases, you can omit these input-file specifications, in which case the utility 
reads from standard input instead. 


File-Combining Commands 


The first text-filtering commands are those used to combine two or more files 
into one file. Three important commands in this category are cat, join, and 
paste, which join files end to end based on fields in the file or by merging on a 
line-by-line basis. 


Combining Files with cat 


The cat command's name is short for concatenate, and this tool does just that: It 
links together an arbitrary number of files end to end and sends the result to 
standard output. By combining cat with output redirection, you can quickly 
combine two files into one: 


$ cat first.txt second.txt > combined.txt 
$ 

$ cat first.txt 

Data from first file. 
$ 

$ cat second.txt 

Data from second file. 
$ 

$ cat combined.txt 
Data from first file. 
Data from second file. 
$ 


Although cat is officially a tool for combining files, it's also commonly used to 

display the contents of a short file to STDOUT. If you type only one filename as 
an option, cat displays that file. This is a great way to review short files; but for 
long files, you're better off using a full-fledged pager command, such as more or 
less. 


You can add options to have cat perform minor modifications to the files as it 
combines them: 


Display Line Ends 


If you want to see where lines end, add the -E or - - show-ends option. The 
result is a dollar sign ($) at the end of each line. 


Number Lines 


The -n or --number option adds line numbers to the beginning of every 
line. The -b or - -number-nonblank option is similar, but it numbers only 
lines that contain text. 


Minimize Blank Lines 


The -s or --squeeze-blank option compresses groups of blank lines down 
to a single blank line. 


Display Special Characters 


The -T or --show-tabs option displays tab characters as aI. The -v or - - 
show-nonprinting option displays most control and other special 
characters using carat (A) and M- notations. 


The tac command is similar to cat, but it reverses the order of lines in the 
output: 


$ cat combined. txt 
Data from first file. 
Data from second file. 
$ 

$ tac combined. txt 
Data from second file. 
Data from first file. 
$ 


Joining Files by Field with join 


The join command combines two files by matching the contents of specified 
fields within the files. Fields are typically space-separated entries on a line. 
However, you can specify another character as the field separator with the -t 
char option, where char is the character you want to use. You can cause join to 
ignore case when performing comparisons by using the -i option. 


The effect of join may best be understood through a demonstration. Consider 
Listing 1.1 and Listing 1.2, which contain data on telephone numbers. Listing 


1.1 shows the names associated with those numbers, and Listing 1.2 shows 
whether the numbers are listed or unlisted. 


Listing 1.1: Demonstration file containing telephone 
numbers and names 


555-2397 Beckett, Barry 
555-5116 Carter, Gertrude 
555-7929 Jones, Theresa 
555-9871 Orwell, Samuel 


Listing 1.2: Demonstration file containing telephone 
number listing status 


555-2397 unlisted 
555-5116 listed 
555-7929 listed 
555-9871 unlisted 





You can display the contents of both files using join: 


$ join listing1.1.txt listing1.2.txt 
555-2397 Beckett, Barry unlisted 
555-5116 Carter, Gertrude listed 
555-7929 Jones, Theresa listed 
555-9871 Orwell, Samuel unlisted 


By default, join uses the first field as the one to match across files. Because 
Listing 1.1 and Listing 1.2 both place the phone number in this field, it's the key 
field in the output. You can specify another field by using the -1 or -2 option to 
indicate the join field for the first or second file, respectively. For example, type 
join -1 3 -2 2 cameras.txt lenses. txt to join using the third field in 
cameras.txt and the second field in lenses. txt. The -o FORMAT option enables 
more complex specifications for the output file's format. You can consult the man 
page for join for even more details. 


The join command can be used at the core of a set of simple customized 
database-manipulation tools using Linux text-manipulation commands. It's very 
limited by itself, though. For instance, it requires its two files to have the same 


ordering of lines. (You can use the sort command to ensure this is so.) 


Merging Lines with paste 


The paste command merges files line by line, separating the lines from each file 
with tabs, as shown in the following example, using Listings 1.1 and 1.2 again: 


$ paste listing1.1.txt listing1.2.txt 


555-2397 Beckett, Barry 555-2397 unlisted 
555-5116 Carter, Gertrude 555-5116 listed 
555-7929 Jones, Theresa 555-7929 listed 
555-9871 Orwell, Samuel 555-9871 unlisted 


You can use paste to combine data from files that aren't keyed with fields 
suitable for use by join. Of course, to be meaningful, the files’ line numbers 
must be exactly equivalent. Alternatively, you can use paste as a quick way to 
create a two-column output of textual data; however, the alignment of the second 
column may not be exact if the first column's line lengths aren't exactly even. 


File-Transforming Commands 


Many of Linux's text-manipulation commands are aimed at transforming the 
contents of files. These commands don't actually change files' contents but 
instead send the changed files' contents to standard output. You can then pipe 
this output to another command or redirect it into a new file. 
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An important file-transforming command is sed. This command is very 
complex and is covered later in this chapter in “Using sed.” 


Converting Tabs to Spaces with expand 


Sometimes text files contain tabs but programs that need to process the files 
don't cope well with tabs. In such a case, you may want to convert tabs to spaces. 
The expand command does this. 


By default, expand assumes a tab stop every eight characters. You can change 
this spacing with the -t num or --tabs=num option, where num is the tab spacing 
value. 


Displaying Files in Octal with od 


Some files aren't easily displayed in ASCII. For example, most graphics files, 
audio files, and so on use non-ASCII characters that look like gibberish. Worse, 
these characters can do strange things to your display if you try to view such a 
file with cat or a similar tool. For instance, your font may change, or your 
console may begin beeping uncontrollably. Nonetheless, you may sometimes 
want to display such files, particularly if you want to investigate the structure of 
a data file. 


In such a case, od (whose name stands for octal dump) can help. It displays a file 
in an unambiguous format—octal (base 8) numbers by default. For instance, 
consider Listing 1.2 as parsed by od: 


$ od listing1.2.txt 

0000000 032465 026465 031462 033471 072440 066156 071551 062564 
0000020 005144 032465 026465 030465 033061 066040 071551 062564 
0000040 005144 032465 026465 034467 034462 066040 071551 062564 
0000060 005144 032465 026465 034071 030467 072440 066156 071551 
0000100 062564 005144 

0000104 


The first field on each line is an index into the file in octal. For instance, the 
second line begins at octal 20 (16 in base 10) bytes into the file. The remaining 


numbers on each line represent the bytes in the file. This type of output can be 
difficult to interpret unless you're well versed in octal notation and perhaps in the 
ASCII code. 


Although od is nominally a tool for generating octal output, it can generate many 
other output formats, such as hexadecimal (base 16), decimal (base 10), and 
even ASCII with escaped control characters. Consult the man page for od for 
details on creating these variants. 


Sorting Files with sort 


Sometimes you'll create an output file that you want sorted. To do so, you can 
use a command that's called, appropriately enough, sort. This command can sort 
in several ways, including the following: 


Ignore Case 


Ordinarily, sort sorts by ASCII value, which differentiates between 
uppercase and lowercase letters. The -f or - -ignore-case option causes 
sort to ignore case. 


Month Sort 


The -M or --month-sort option causes the program to sort by three-letter 
month abbreviation (JAN through DEC). 


Numeric Sort 

You can sort by number by using the -n or --numeric-sort option. 
Reverse Sort Order 

The -r or --reverse option sorts in reverse order. 

Sort Field 


By default, sort uses the first field as its sort field. You can specify another 
field with the -k field or --key=field option. (The field can be two 
numbered fields separated by commas, to sort on multiple fields.) 


As an example, suppose you wanted to sort Listing 1.1 by first name. You could 
do so like this: 


$ sort -k 3 listing1.1.txt 
555-2397 Beckett, Barry 
555-5116 Carter, Gertrude 
555-9871 Orwell, Samuel 


555-7929 Jones, Theresa 


The sort command supports a large number of additional options, many of them 
quite exotic. Consult sort's man page for details. 


Breaking a File into Pieces with split 


The split command can split a file into two or more files. Unlike most of the 
text-manipulation commands described in this chapter, this command requires 
you to enter an output filename or, more precisely, an output filename prefix, to 
which is added an alphabetic code. You must also normally specify how large 
you want the individual files to be: 


Split by Bytes 


The -b size or --bytes=size option breaks the input file into pieces of 
size bytes. This option can have the usually undesirable consequence of 
splitting the file mid-line. 


Split by Bytes in Line-Sized Chunks 


You can break a file into files of no more than a specified size without 
breaking lines across files by using the -C=size or - -line-bytes=size 
option. (Lines will still be broken across files if the line length is greater 
than size.) 


Split by Number of Lines 


The -1 lines or --lines=lines option splits the file into chunks with no 
more than the specified number of lines. 


As an example, consider breaking Listing 1.1 into two parts by number of lines: 


$ split -1 2 listing1.1.txt numbers 


The result is two files, numbersaa and numbersab, which together hold the 
original contents of listing1.1.txt. 


If you don't specify any defaults (as in split listing1i.1.txt), the result is 
output files split into 1,000-line chunks, with names beginning with x (xaa, xab, 
and so on). If you don't specify an input filename, split uses standard input. 


Translating Characters with tr 


The tr command changes individual characters from standard input. Its syntax is 
as follows: 


tr [options] SET1 [SET2] 


You specify the characters you want replaced in a group (SET1) and the 
characters with which you want them to be replaced as a second group (SET2). 
Each character in SET1 is replaced with the one at the equivalent position in 
SET2. Here's an example using Listing 1.1: 


$ tr BCJ 
555-2397 
555-5116 
555-7929 
555-9871 


be < listing1.1.txt 
beckett, barry 
carter, Gertrude 
cones, Theresa 
Orwell, Samuel 
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The tr command relies on standard input, which is the reason for the input 
redirection (<) in this example. This is the only way to pass the command a 
file. 


This example translates some, but not all, of the uppercase characters to 
lowercase. Note that SET2 in this example was shorter than SET1. The result is 
that tr substitutes the last available letter from SET2 for the missing letters. In 
this example, the J in Jones became a c. The -t or --truncate-set1 option 
causes tr to truncate SET1 to the size of SET2 instead. 


Another tr option is -d, which causes the program to delete the characters from 
SET1. When using -d, you omit SET2 entirely. 


The tr command also accepts a number of shortcuts, such as [:alnum: ] (all 
numbers and letters), [: upper: ] (all uppercase letters), [ : lower: ] (all lowercase 
letters), and [:digit: ] (all digits). You can specify a range of characters by 
separating them with dashes (-), as in A-M for characters between A and m, 
inclusive. Consult tr's man page for a complete list of these shortcuts. 


Converting Spaces to Tabs with unexpand 


The unexpand command is the logical opposite of expand; it converts multiple 
spaces to tabs. This can help compress the size of files that contain many spaces 
and can be helpful if a file is to be processed by a utility that expects tabs in 
certain locations. 


Like expand, unexpand accepts the -t num or - -tabs=num option, which sets the 
tab spacing to once every num characters. If you omit this option, unexpand 
assumes a tab stop every eight characters. 


Deleting Duplicate Lines with uniq 


The uniq command removes duplicate lines. It's most likely to be useful if 
you've sorted a file and don't want duplicate items. For instance, suppose you 
want to summarize Shakespeare's vocabulary. You might create a file with all of 
the Bard's works, one word per line. You can then sort this file using sort and 


pass it through uniq. Using a shorter example file containing the text to be or 
not to be, that is the question (one word per line), the result looks like 
this: 


$ sort shakespeare.txt | uniq 
be 

is 

not 

or 

question 

that 

the 

to 


Note that the words to and be, which appeared in the original file twice, appear 
only once in the uniq-processed version. 


File-Formatting Commands 


The next three commands—fnt, n1, and pr—reformat the text in a file. The first 
of these is designed to reformat text files, such as when a program's README 
documentation file uses lines that are too long for your display. The n1 command 
numbers the lines of a file, which can be helpful in referring to lines in 
documentation or correspondence. Finally, pr is a print-processing tool; it 
formats a document in pages suitable for printing. 


Reformatting Paragraphs with fmt 


Sometimes text files arrive with outrageously long line lengths, irregular line 
lengths, or other problems. Depending on the difficulty, you may be able to cope 
simply by using an appropriate text editor or viewer to read the file. If you want 
to clean up the file a bit, though, you can do so with fmt. If called with no 
options (other than the input filename, if you're not having it work on standard 
input), the program attempts to clean up paragraphs, which it assumes are 
delimited by two or more blank lines or by changes in indentation. The new 
paragraph formatting defaults to paragraphs that are no more than 75 characters 
wide. You can change this with the -width, -w width, and --width=width 
options, which set the line length to width characters. 


Numbering Lines with nl 


As described earlier, in “Combining Files with cat,” you can number the lines of 
a file with that command. The cat line-numbering options are limited, though, if 


you need to do complex line numbering. The nl command is the tool to use in 
this case. In its simplest form, you can use n1 alone to accomplish much the 
same goal as cat -b achieves: numbering all the non-blank lines in a file. You 
can add many options to n1 to achieve various special effects: 


Body Numbering Style 


You can set the numbering style for the bulk of the lines with the -b style 
or - -body-numbering=style option, where style is a style format code, 
described shortly. 


Header and Footer Numbering Style 


If the text is formatted for printing and has headers or footers, you can set 
the style for these elements with the -h style or - -header - 

number ing=style option for the header and -f style or --footer- 
number ing=style option for the footer. 


Page Separator 


Some numbering schemes reset the line numbers for each page. You can 
tell n1 how to identify a new page with the -d=code or - - section- 
delimiter=code option, where code is a code for the character that 
identifies the new page. 


Line-Number Options for New Pages 


Ordinarily, n1 begins numbering each new page with line 1. If you pass the 
-p or --no-renumber option, though, it doesn't reset the line number with a 
new page. 


Number Format 


You can specify the numbering format with the -n format or - -number - 
format=format option, where format is 1n (left justified, no leading zeros), 
rn (right justified, no leading zeros), or rz (right justified with leading 
Zeros). 


The body, header, and footer options enable you to specify a numbering style for 
each of these page elements, as described in Table 1.3. 


Table 1.3 Styles used by n1 


Style Description 
code 


t The default behavior is to number lines that aren't empty. You can 
make this default explicit by using a style code of t. 


a This style code causes all lines to be numbered, including empty lines. 


n This style code causes all line numbers to be omitted, which may be 
desirable for headers or footers. 


pREGEXP This option causes only lines that match the specified regular 
expression (REGEXP) to be numbered. Regular expressions are 
described later in “‘Using Regular Expressions." 


As an example, suppose you've created a script, buggy, but you find that it's not 
working as you expect. When you run it, you get error messages that refer to line 
numbers, so you want to create a version of the script with lines that are 
numbered for easy reference. You can do so by calling n1 with the option to 
number all lines, including blank lines (-b a): 


$ nl -b a buggy > numbered-buggy.txt 
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Because the input file doesn't have any explicit page delimiters, the output 
will be numbered in a single sequence. The nl command doesn't try to 
impose its own page-length limits. 


The numbered-buggy.txt file created by this command isn't useful as a script 
because of the line numbers that begin each line. You can, however, load it into 
a text editor or display it with a pager such as less to view the text and see the 
line numbers along with the commands they contain. 


Preparing a File for Printing with pr 


If you want to print a plain-text file, you may want to prepare it with headers, 
footers, page breaks, and so on. The pr command was designed to do this. In its 
most basic form, you pass the command a file: 


$ pr myfile.txt 


The result is text formatted for printing on a line printer—that is, pr assumes an 
80-character line length in a monospaced font. Of course, you can also use pr in 
a pipe, either to accept input piped from another program or to pipe its output to 
another program. (The recipient program might be lpr, which is used to print 
files, as described in Chapter 6, “Configuring the X Window System, 
Localization, and Printing.”’) 


By default, pr creates output that includes the original text with headers, which 
lists the current date and time, the original filename, and the page number. You 
can tweak the output format in a variety of ways, including the following: 


Generate Multicolumn Output 


Passing the -numcols or - -columns=numcols option creates output with 
numcols columns. For example, if you typed pr -3 myfile.txt, the output 
would be displayed in three columns. Note that pr doesn't reformat text; if 
lines are too long, they're truncated or run over into multiple columns. 


Generate Double-Spaced Output 


The -d or - -double-space option causes double-spaced output from a 
single-spaced file. 


Use Form Feeds 


Ordinarily, pr separates pages by using a fixed number of blank lines. This 
works fine if your printer uses the same number of lines that pr expects. If 
you have problems with this issue, you can pass the -F, -f, or --form-feed 
option, which causes pr to output a form-feed character between pages. 
This works better with some printers. 


Set Page Length 
The -1 lines or --length=lines option sets the length of the page in lines. 
Set the Header Text 


The -h text or --header=text option sets the text to be displayed in the 
header, replacing the filename. To specify a multi-word string, enclose it in 
quotes, as in --header="My File”. The -t or --omit-header option omits 
the header entirely. 


Set Left Margin and Page Width 


The -o chars or --indent=chars option sets the left margin to chars 
characters. This margin size is added to the page width, which defaults to 
72 characters and can be explicitly set with the -w chars or - -width chars 
option. 


These options are just the beginning; pr supports many more options, which are 
described in its man page. As an example of pr in action, consider printing a 
double-spaced and numbered version of a configuration file (say, etcprofile) 
for your reference. You can do this by piping together cat and its -n option to 
generate a numbered output, pr and its -d option to double-space the result, and 
lpr to print the file: 


$ cat -n etcprofile | pr -d | lpr 


The result should be a printout that might be handy for taking notes on the 
configuration file. One caveat, though: If the file contains lines that approach or 
exceed 80 characters in length, the result can be single lines that spill across two 
lines. The result will be disrupted page boundaries. As a workaround, you can 
set a somewhat short page length with -1 and use -f to ensure that the printer 
receives form feeds after each page: 


$ cat -n etcprofile | pr -dfl 50 | lpr 


A 


The pr command is built around assumptions about printer capabilities that 
were reasonable in the early 1980s. It's still useful today, but you might 
prefer to look into GNU Enscript 
(www.codento.com/people/mtr/genscript/). This program has many of 
the same features as pr, but it generates PostScript output that can take better 
advantage of modern printer features. 





File-Viewing Commands 


Sometimes you just want to view a file or part of a file. A few commands can 
help you accomplish this goal without loading the file into a full-fledged editor. 
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r 
As described earlier, the cat command is also handy for viewing short files. 


Viewing the Starts of Files with head 


Sometimes all you need to do is see the first few lines of a file. This may be 
enough to identify what a mystery file is, for instance; or you may want to see 
the first few entries of a log file to determine when that file was started. You can 
accomplish this goal with the head command, which echoes the first 10 lines of 
one or more files to standard output. (If you specify multiple filenames, each 
one's output is preceded by a header to identify it.) You can modify the amount 
of information displayed by head in two ways: 


Specify the Number of Bytes 


The -c num or --bytes=num option tells head to display num bytes from the 
file rather than the default 10 lines. 


Specify the Number of Lines 


You can change the number of lines displayed with the -n num or - - 
lines=num option. 


Viewing the Ends of Files with tail 


The tail command works just like head, except that tail displays the last 10 
lines of a file. (You can use the -c or --bytes, and -n or - -lines options to 
change the amount of data displayed, just as with head.) This command is useful 
for examining recent activity in log files or other files to which data may be 
appended. 


The tail command supports several options that aren't present in head and that 
enable the program to handle additional duties, including the following: 


Track a File 


The -f or - -follow option tells tail to keep the file open and to display 
new lines as they're added. This feature is helpful for tracking log files 
because it enables you to see changes as they're made to the file. 


Stop Tracking on Program Termination 


The - -pid=pid option tells tail to terminate tracking (as initiated by -f or 
-- follow) once the process with a process ID (PID) of pid terminates. 
(PIDs are described in more detail in Chapter 2, “Managing Software.”) 


Some additional options provide more obscure capabilities. Consult tail's man 
page for details. 
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You can combine head with tail to display or extract portions of a file. For 
instance, suppose you want to display lines 11 through 15 of a file, 
sample.txt. You can extract the first 15 lines of the file with head and then 
display the last five lines of that extraction with tail. The final command 
would be head -n 15 sample.txt | tail -n 5. 


Paging through Files with Jess 


The less command's name is a joke; it's a reference to the more command, 
which was an early file pager. The idea was to create a better version of more, so 
the developers called it less (“less is more”). 


The idea behind less (and more, for that matter) is to enable you to read a file a 
screen at a time. When you type less filename, the program displays the first 
few lines of filename. You can then page back and forth through the file: 


Pressing the spacebar moves forward through the file a screen at a time. 


Pressing Esc followed by V moves backward through the file a screen at a 
time. 


The Up and Down arrow keys move up or down through the file a line at a 
time. 


You can search the file's contents by pressing the slash (/) key followed by 
the search term. For instance, typing /portable finds the first occurrence of 
the string portable after the current position. Typing a slash followed by 
the Enter key moves to the next occurrence of the search term. Typing n 
alone repeats the search forward, while typing N alone repeats the search 
backward. 


You can search backward in the file by using the question mark (?) key 
rather than the slash key. 


You can move to a specific line by typing g followed by the line number, as 
in g50 to go to line 50. 


e When you're done, type q to exit from the program. 


Unlike most of the programs described here, less can't be readily used in a pipe, 
except as the final command in the pipe. In that role, though, less is very useful 
because it enables you to examine lengthy output conveniently. 
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Although less is quite common on Linux systems and is typically 
configured as the default text pager, some Unix-like systems use more in this 
role. Many of less's features, such as the ability to page backward in a file, 
don't work in more. 


One additional less feature can be handy: Typing h displays less's internal help 
system. This display summarizes the commands you may use, but it's long 
enough that you must use the usual less paging features to view it all! When 
you're done with the help screens, just type q as if you were exiting from 
viewing a help document with less. This action will return you to your original 
document. 


File-Summarizing Commands 


The final text-filtering commands described here are used to summarize text in 
one way or another. The cut command takes segments of an input file and sends 
them to standard output, while the wc command displays some basic statistics on 
the file. 


Extracting Text with cut 


The cut command extracts portions of input lines and displays them on standard 
output. You can specify what to cut from input lines in several ways: 


By Byte 

The -b list or --bytes=list option cuts the specified list of bytes from 
the input file. (The format of list is described shortly.) 

By Character 


The -c list or --characters=list option cuts the specified list of 
characters from the input file. In practice, this method and the by-byte 
method usually produce identical results. (If the input file uses a multibyte 
encoding system, though, the results won't be identical.) 


By Field 


The -f list or --fields=list option cuts the specified list of fields from 
the input file. By default, a field is a tab-delimited section of a line, but you 
can change the delimiting character with the -d char, --delim=char, or - - 
delimiter=char option, where char is the character you want to use to 
delimit fields. Ordinarily, cut echoes lines that don't contain delimiters. 
Including the -s or - -only-delimited option changes this behavior so that 
the program doesn't echo lines that don't contain the delimiter character. 


Many of these options take a list option, which is a way to specify multiple 
bytes, characters, or fields. You make this specification by number. It can be a 
single number (such as 4), a closed range of numbers (such as 2-4), or an open 
range of numbers (such as -4 or 4-). In this final case, all bytes, characters, or 
fields from the beginning of the line to the specified number (or from the 
specified number to the end of the line) are included in the list. 


The cut command is frequently used in scripts to extract data from some other 
command's output. For instance, suppose you're writing a script and the script 
needs to know the hardware address of your Ethernet adapter. This information 
can be obtained from the ifconfig command (described in more detail in 
Chapter 8, “Configuring Basic Networking”): 


$ ifconfig etho 
etho Link encap:Ethernet HWaddr 00:0C:76:96:A3:73 

inet addr:192.168.1.3 Bcast:192.168.1.255 
Mask:255.255.255.0 

inet6 addr: fe80::20c:76ff:fe96:a373/64 Scope:Link 

UP BROADCAST NOTRAILERS RUNNING MULTICAST MTU:1500 
Metric:1 

RX packets:7127424 errors:0 dropped:0 overruns:0 frame:0 

TX packets:5273519 errors:0 dropped:0 overruns:0 
carrier:0 

collisions:0 txqueuelen:1000 

RX bytes:6272843708 (5982.2 Mb) TX bytes:1082453585 
(1032.3 Mb) 

Interrupt:10 Base address:0xde00 


Unfortunately, most of this information is extraneous for the desired purpose. 
The hardware address is the 6-byte hexadecimal number following HWaddr. To 
extract that data, you can combine grep (described shortly in “Using grep”) with 
cut in a pipe: 


$ ifconfig ethO | grep HWaddr | cut -d " " -f 11 
00:0C: 76:96:A3: 73 


Of course, in a script, you would probably assign this value to a variable or 
otherwise process it through additional pipes. (Chapter 9 describes scripts in 
more detail.) 


Obtaining a Word Count with wc 


The wc command produces a word count (that's where it gets its name), as well 
as line and byte counts, for a file: 


$ we file.txt 
308 2343 15534 file.txt 


This file contains 308 lines (or more precisely, 308 newline characters), 2,343 
words, and 15,534 bytes. You can limit the output to the newline count, the word 
count, the byte count, or a character count with the --lines (-1), - -words (-w), - 
-bytes (-c), or --chars (-m) option, respectively. You can also learn the 
maximum line length with the - -max-line-length (-L) option. 
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For an ordinary ASCII file, the character and byte counts will be identical. 
These values may diverge for files that use multibyte character encodings. 


Using Regular Expressions 


Many Linux programs employ regular expressions, which are tools for 
describing or matching patterns in text. Regular expressions are similar in 
principle to the wildcards that can be used to specify multiple filenames. At their 
simplest, regular expressions can be plain text without adornment. However, 
certain characters are used to denote patterns. Because of their importance, 
regular expressions are described in the following section. 


Two programs that make heavy use of regular expressions, grep and sed, are 
also covered. These programs search for text within files and permit editing of 
files from the command line, respectively. 


Understanding Regular Expressions 


Two forms of regular expression are common: basic and extended. Which form 
you must use depends on the program. Some accept one form or the other, but 
others can use either type, depending on the options passed to the program. 
(Some programs use their own minor or major variants on either of these classes 
of regular expression.) The differences between basic and extended regular 
expressions are complex and subtle, but the fundamental principles of both are 
similar. 


The simplest type of regular expression is an alphabetic string, such as Linux or 
Hwaddr. These regular expressions match any string of the same size or longer 
that contains the regular expression. For instance, the Hwaddr regular expression 
matches HWaddr, This is the HWaddr, and The HWaddr is unknown. The real 
strength of regular expressions comes in the use of nonalphabetic characters, 
which activate advanced matching rules: 


Bracket Expressions 


Characters enclosed in square brackets ([]) constitute bracket expressions, 
which match any one character within the brackets. For instance, the 
regular expression b[aeiou]g matches the words bag, beg, big, bog, and 
bug. 


Range Expressions 


A range expression is a variant of a bracket expression. Instead of listing 
every character that matches, range expressions list the start and end points 


separated by a dash (-), as in a[2-4]z. This regular expression matches 
a2z, a3z, and a4z. 


Any Single Character 


The dot (.) represents any single character except a newline. For instance, 
a.z matches a2z, abz, aQz, or any other three-character string that begins 
with a and ends with z. 


Start and End of Line 


The carat (A) represents the start of a line, and the dollar sign ($) denotes the 
end of a line. 


Repetition Operators 


A full or partial regular expression may be followed by a special symbol to 
denote how many times a matching item must exist. Specifically, an 
asterisk (*) denotes zero or more occurrences, a plus sign (+) matches one 
or more occurrences, and a question mark (?) specifies zero or one match. 
The asterisk is often combined with the dot (as in . *) to specify a match 
with any substring. For instance, A. *Lincoln matches any string that 
contains A and Lincoln, in that order—Abe Lincoln and Abraham Lincoln 
are just two possible matches. 


Multiple Possible Strings 


The vertical bar (|) separates two possible matches; for instance, car | truck 
matches either car or truck. 


Parentheses 


Ordinary parentheses (()) surround subexpressions. Parentheses are often 
used to specify how operators are to be applied; for example, you can put 
parentheses around a group of words that are concatenated with the vertical 
bar to ensure that the words are treated as a group, any one of which may 
match, without involving surrounding parts of the regular expression. 


Escaping 


If you want to match one of the special characters, such as a dot, you must 
escape it—that is, precede it with a backslash (\). For instance, to match a 
computer hostname (say, twain.example.com), you must escape the dots, 
as in twain\.example\.com. 


The preceding descriptions apply to extended regular expressions. Some details 


are different for basic regular expressions. In particular, the ?, +, |, (, and ) 
symbols lose their special meanings. To perform the tasks handled by these 
characters, some programs, such as grep, enable you to recover the functions of 
these characters by escaping them (say, using \| instead of |). Whether you use 
basic or extended regular expressions depends on which form the program 
supports. For programs such as grep, which support both, you can use either. 
Which form you choose is mostly a matter of personal preference. 
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You can get more help on regular expressions at the command-line by typing 
man 7 regex. The certification objectives list this particular man page as 
regex(7). 


Regular expression rules can be confusing, particularly when you're first 
introduced to them. Some examples of their use, in the context of the programs 
that use them, will help. The next couple of sections provide such examples. 


Using grep 


The grep command is extremely useful. It searches for files that contain a 
specified string and returns the name of the file and (if it's a text file) a line of 
context for that string. The basic grep syntax is as follows: 


grep [options] regexp [files] 
The regexp is a regular expression, as just described. The grep command 


supports a large number of options. Some of the common options enable you to 
modify the way the program searches files: 


Count Matching Lines 


Instead of displaying context lines, grep displays the number of lines that 
match the specified pattern if you use the -c or - -count option. 


Specify a Pattern Input File 


The -f file or --file=file option takes pattern input from the specified 
file rather than from the command line. 


Ignore Case 


You can perform a search that isn't case sensitive, rather than the default 
case-sensitive search, by using the -i or --ignore-case option. 


Search Recursively 


The -r or - -recursive option searches in the specified directory and all 
subdirectories rather than simply the specified directory. You can use rgrep 


rather than specify this option. 
Use a Fixed Strings Pattern 


If you want to turn off the grep command's use of regular expressions and 
use basic pattern searching instead, you can use the -F or --fixed-strings 
option. Alternatively, you can use fgrep rather than grep. Either way, the 
characters in the basic pattern string are treated literally. For example, $ is 
treated literally as a $ and not as a regular expression. 


Use an Extended Regular Expression 


The grep command interprets regexp as a basic regular expression by 
default. To use an extended regular expression, you can pass the -E or - - 
extended-regexp option. Alternatively, you can call egrep rather than 
grep. This variant command uses extended regular expressions by default. 


A simple example of grep uses a regular expression with no special components: 


$ grep -r ethO etc* 


This example finds all the files in /etc that contain the string etho (the identifier 
for the first wired Ethernet device on most Linux distributions). Because the 
example includes the -r option, it searches recursively, so files in subdirectories 
of /etc are examined in addition to those in /etc itself. For each matching text 
file, the line that contains the string is printed. 


pom 


Some files in /etc can't be read by ordinary users. Thus if you type this 
command as a non-root user, you'll see some error messages relating to 
grep's inability to open files. 


Suppose you want to locate all the files in /etc that contain the string etho or 
eth1. You can enter the following command, which uses a bracket expression to 
specify both variant devices: 


$ grep eth[01] etc* 


A still more complex example searches all files in /etc that contain the 
hostname twain.example.com or bronto.pangaea.edu and, later on the same 
line, the number 127. This task requires using several of the regular expression 
features. Expressed using extended regular expression notation, the command 
looks like this: 


$ grep -E "(twain\.example\.com|bronto\.pangaea\.edu) .*127" etc* 


This command illustrates another feature you may need to use: shell quoting. 
Because the shell uses certain characters, such as the vertical bar and the 
asterisk, for its own purposes, you must enclose certain regular expressions in 
quotes lest the shell attempt to parse the regular expression and pass a modified 
version of what you type to grep. 


You can use grep in conjunction with commands that produce a lot of output in 
order to sift through that output for the material that's important to you. (Several 
examples throughout this book use this technique.) For example, suppose you 
want to find the process ID (PID) of a running xterm. You can use a pipe to send 
the result of a ps command (described in Chapter 2) through grep: 


# ps ax | grep xterm 


The result is a list of all running processes called xterm, along with their PIDs. 
You can even do this in series, using grep to restrict further the output on some 
other criterion, which can be useful if the initial pass still produces too much 
output. 


Using sed 


The sed command directly modifies a file's contents, sending the changed file to 
standard output. Its syntax can take one of two forms: 


sed [options] -f script-file [input -file] 
sed [options] script-text [input-file] 


In either case, input - file is the name of the file you want to modify. 
(Modifications are temporary unless you save them in some way, as illustrated 
shortly.) The script (script -text or the contents of script - file) is the set of 
commands you want sed to perform. When you pass a script directly on the 
command line, the script -text is typically enclosed in single quote marks. 
Table 1.4 summarizes a few sed commands that you can use in its scripts. 


Table 1.4 Common sed commands 


Command 

= Oorl 
a\text Oorl1 
i\text Oorl 
r filename Oorl 
c\text Range 


s/regexp/replacement Range 


w filename Range 
q Oorl 
Q Oorl 


Addresses Meaning 


Display the current line number. 
Append text to the file. 

Insert text into the file. 

Append text from filename into the file. 


Replace the selected range of lines with the 
provided text. 


Replace text that matches the regular 
expression (regexp) with replacement. 


Write the current pattern space to the 
specified file. 


Immediately quit the script, but print the 
current pattern space. 


Immediately quit the script. 


pom 


Table 1.4 is incomplete; sed is quite complex, and this section merely 
introduces this tool. 


The Addresses column of Table 1.4 requires elaboration: sed commands operate 
on addresses, which are line numbers. Commands may take no addresses, in 
which case they operate on the entire file. If one address is specified, they 
operate on the specified line. If two addresses (a range) are specified, the 
commands operate on that range of lines, inclusive. 


In operation, sed looks something like this: 


$ sed 's/2012/2013/' cal-2012.txt > cal-2013.txt 


This command processes the input file, cal-2012.txt, using sed's s command 
to replace the first occurrence of 2012 on each line with 2013. (If a single line 
may have more than one instance of the search string, you must perform a global 
search by appending g to the command string, as in s/2012/2013/g.) By default, 
sed sends the modified file to standard output, so this example uses redirection 
to send the output to cal-2013.txt. The idea in this example is to convert a file 
created for the year 2012 quickly so that it can be used in 2013. If you don't 
specify an input filename, sed works from standard input, so it can accept the 
output of another command as its input. 


Although it's conceptually simple, sed is a very complex tool; even a modest 
summary of its capabilities would fill a chapter. You can consult its man page for 
basic information, but to understand sed fully, you may want to consult a book 
that tackles this tough subject, such as our book Linux Command Line and Shell 
Scripting Bible, 3rd Edition (Wiley, 2015). 


A JTE 


AA 


Certain sed commands, including the substitution command, are also used in 
vi, which is described more fully in Chapter 5. 


Doing One Thing in Many Ways 


As you become experienced with Linux and compare notes with other Linux 
administrators, you may find that the way you work is different from the 
way others work. This is because Linux often provides multiple methods to 
solve certain problems. For instance, ASCII text files use certain characters 
to encode the end of a line. Unix (and Linux) use a single line feed character 
(ASCII 0x0a, sometimes represented as \n), whereas DOS and Windows use 
the combination of a carriage return (ASCII O0x0d or \r) and a line feed. 
When moving ASCII files between computers, you may need to convert 
from one form to the other. How can you do this? 


One solution is to use a special-purpose program, such as dos2unix or 
unix2dos. You could type dos2unix file.txt to convert file.txt from 
DOS-style to Unix-style ASCII, for instance. This is usually the simplest 
solution, but not all distributions have these utilities installed by default or 
even available to install. 


Another approach is to use tr. For instance, to convert from DOS style to 
Unix style, you might type this: 


$ tr -d [[backslash backslash]]r < dosfile.txt > unixfile.txt 


This approach won't work when converting from Unix style to DOS style, 
though. For that, you can use sed: 


sed s/$/"\r"/ unixfile.txt > dosfile.txt 





Variants on both the tr and sed commands exist. For instance, sometimes 
the quotes around \r may be omitted from the sed command; whether 
they're required depends on your shell and its configuration. 


Yet another approach is to load the file into a text editor and then save it 
using different file-type settings. (Not all editors support such changes, but 
some do.) 


Many other examples exist of multiple solutions to a problem. Sometimes 
one solution stands out above others as being superior, but at other times the 
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situations. Thus it's best to be at least somewhat familiar with many of the 
alternatives, such as the options described throughout this book. 





Summary 


The command line is the key to Linux. Even if you prefer GUI tools to text- 
mode tools, understanding text-mode commands is necessary to fully manage a 
Linux system. This task begins with the shell, which accepts commands you type 
and displays the results of those commands. In addition, shells support linking 
programs together via pipes and redirecting programs’ input and output. These 
features enable you to perform complex tasks using simple tools by having each 
program perform its own small part of the task. This technique is frequently used 
with Linux text filters, which manipulate text files in various ways—sorting text 
by fields, merging multiple files, and so on. 


Exam Essentials 


Summarize features that Linux shells offer to speed up command 
entry. 


The command history often enables you to retrieve an earlier command 
that's similar or identical to the one you want to enter. Tab completion 
reduces typing effort by letting the shell finish long command names or 
filenames. Command-line editing lets you edit a retrieved command or 
change a typo before committing the command. 


Describe the purpose of the man command. 


The man command displays the manual page for the keyword (command, 
filename, system call, or other feature) that you type. This documentation 
provides succinct summary information that's useful as a reference to learn 
about exact command options or features. 


Explain the purpose of environment variables. 


Environment variables store small pieces of data—program options, 
information about the computer, and so on. This information can be read by 
programs and used to modify program behavior in a way that's appropriate 
for the current environment. 


Describe the difference between standard output and standard error. 


Standard output carries normal program output, whereas standard error 
carries high-priority output, such as error messages. The two can be 
redirected independently of one another. 


Explain the purpose of pipes. 


Pipes tie programs together by feeding the standard output from the first 
program into the second program's standard input. They can be used to link 
together a series of simple programs to perform more complex tasks than 
any one of the programs could manage. 


Describe the filter commands. 


The various simple filter commands allow the manipulation of text. These 
commands accomplish tasks of various types, such as combining files, 
transforming the data in files, formatting text, displaying text, and 
summarizing data. 


Summarize the structure of regular expressions. 


Regular expressions are strings that describe other strings. They can contain 
normal alphanumeric characters, which match the exact same characters in 
the string they are describing, as well as several special symbols and 
symbol sets that match multiple different characters. The combination is a 
powerful pattern-matching tool used by many Linux programs. 


Review Questions 


1. You type a command into bash and pass a long filename to it, but after you 
enter the command, you receive a File not found error message because of 
a typo in the filename. How might you proceed? 


A. Retype the command, and be sure you type the filename correctly, letter by 
letter. 


B. Retype the command, but press the Tab key after typing a few letters of the 
long filename to ensure that the filename is entered correctly. 


C. Press the Up arrow key, and use bash's editing features to correct the typo. 
D. Any of the above. 
E. None of the above. 


2. Which of the following commands is implemented as an internal command in 
bash? 


A. cat 
B. less 
C. tee 
D. sed 
E. echo 


3. You type echo $PROC, and the computer replies Go away. What does this 
mean? 


A. No currently running processes are associated with your shell, so you may 
log out without terminating them. 


B. The remote computer PROC isn't accepting connections; you should contact 
its administrator to correct the problem. 


C. Your computer is handling too many processes; you must kill some of them 
to regain control of the computer. 


D. Your central processing unit (CPU) is defective and must be replaced as 
soon as possible. 


E. You, one of your configuration files, or a program you've run has set the 


$PROC environment variable to Go away. 
4. What does the pwd command accomplish? 
A. It prints the name of the working directory. 
B. It changes the current working directory. 
C. It prints wide displays on narrow paper. 
D. It parses web page URLs for display. 
E. It prints the terminal's width in characters. 


5. What is the surest way to run a program (say, myprog) that's located in the 
current working directory? 


A. Type ./ followed by the program name: ./myprog. 

B. Type the program name alone: myprog. 

C. Type run followed by the program name: run myprog. 

D. Type /. followed by the program name: /.myprog. 

E. Type the program name followed by an ampersand (&): myprog &. 
6. How does man display information by default on most Linux systems? 

A. Using a custom X-based application 

B. Using the Firefox web browser 

C. Using the info browser 

D. Using the vi editor 

E. Using the less pager 


7. You want to store the standard output of the ifconfig command in a text file 
(file.txt) for future reference, and you want to wipe out any existing data in 
the file. You do not want to store standard error in this file. How can you 
accomplish these goals? 


A. ifconfig < file.txt 
B. ifconfig >> file.txt 
C. ifconfig > file.txt 


D. ifconfig | file.txt 


E. ifconfig 2> file.txt 


8. What is the effect of the following command? 
$ myprog & input.txt 


A. Standard error to myprog is taken from input.txt. 
B. Standard input to myprog is taken from input.txt. 
C. Standard output and standard error from myprog are written to input.txt. 
D. All of the above. 
E. None of the above. 

9. How many commands can you pipe together at once? 
A. 2 
B. 3 
Cc. 4 
D. 16 
E. >16 


10. You want to run an interactive script, gabby, which produces a lot of output 
in response to the user's inputs. To facilitate future study of this script, you 
want to copy its output to a file. How might you do this? 


A. gabby > gabby-out.txt 

B. gabby | tee gabby-out.txt 
C. gabby < gabby-out.txt 

D. gabby &> gabby-out.txt 
E. gabby `gabby-out.txt` 


11. A text-mode program, verbose, prints a lot of bogus “error” messages to 
standard error. How might you get rid of those messages while still 
interacting with the program? 


A. verbose | quiet 
B. verbose &> devnull 


C. verbose 2> devnull 


D. verbose > junk.txt 
E. quiet-mode verbose 
12. How do the > and >> redirection operators differ? 


A. The > operator creates a new file or overwrites an existing one; the >> 
operator creates a new file or appends to an existing one. 


B. The > operator creates a new file or overwrites an existing one; the >> 
operator appends to an existing file or issues an error message if the 
specified file doesn't exist. 


C. The > operator redirects standard output; the >> operator redirects standard 
error. 


D. The > operator redirects standard output; the >> operator redirects standard 
input. 


E. The > operator writes to an existing file but fails if the file doesn't exist; the 
>> operator writes to an existing file or creates a new one if it doesn't 
already exist. 


13. What program would you use to display the end of a configuration file? 
A. uniq 
B. cut 
C. tail 
D. wc 
E. fmt 
14. What is the effect of the following command? 


$ pr report.txt | lpr 


A. The file report .txt is formatted for printing and sent to the lpr program. 


B. The files report.txt and lpr are combined together into one file and sent 
to standard output. 


C. Tabs are converted to spaces in report.txt, and the result is saved in lpr. 


D. The file report .txt is printed, and any error messages are stored in the file 
lpr. 


E. None of the above. 


15. Which of the following commands will number the lines in aleph. txt? 
(Select three.) 


A. fmt aleph.txt 

B. nl aleph.txt 

C. cat -b aleph.txt 
D. cat -n aleph.txt 
E. od -nl aleph.txt 


16. You have a data file, data.txt, to be processed by a particular program. 
However, the program cannot handle data separated by tabs. The data. txt 
file's data is separated by a tab stop at every eight characters. What command 
should you use before processing the data file with the program? 


A. od data.txt > data1.txt 
B. expand data.txt >> data.txt 
C. fmt --remove-tabs data.txt 
D. expand data.txt > data1.txt 
E. unexpand -t 8 data.txt 


17. Which of the following commands will change all occurrences of dog in the 
file animals. txt to mutt in the screen display? 


A. sed -s “dog” “mutt” animals.txt 

B. grep -s "dog||mutt” animals.txt 

C. sed 's/dog/mutt/g' animals.txt 

D. cat animals.txt | grep -c “dog” “mutt” 
E. fmt animals.txt | cut 'dog' > 'mutt' 


18. You've received an ASCII text file (longlines. txt) that uses no carriage 
returns within paragraphs but two carriage returns between paragraphs. The 
result is that your preferred text editor displays each paragraph as a very long 
line. How can you reformat this file so that you can more easily edit it (or a 
copy)? 

A. sed 's/Ctr1-M/NL/' longlines.txt 


B. fmt longlines.txt > longlines2.txt 


C. cat longlines.txt > longlines2.txt 
D. pr longlines.txt > longlines2.txt 
E. grep longlines.txt > longlines2.txt 


19. Which of the following commands will print lines from the file world. txt 
that contain matches to changes and changed? 


A. grep change[ds] world.txt 
B. sed change[d-s] world.txt 
C. od “change'd|s”' world.txt 
D. cat world.txt changes changed 
E. find world.txt “change(d|s)” 


20. Which of the following regular expressions will match the strings dog, dug, 
and various other strings but not dig? 


A.d.g 
B. d[ou]g 
C. d[o-u]g 
D. di*g 
E. d.ig 


Chapter 2 
Managing Software 


THE FOLLOWING EXAM OBJECTIVES ARE COVERED IN THIS 
CHAPTER: 


Y 102.3 Manage shared libraries 

Y 102.4 Use Debian package management 

Y 102.5 Use RPM and Yum package management 
Y 103.5 Create, monitor, and kill processes 


v 103.6 Modify process execution priorities 


A Linux system is defined largely by the collection of software it contains. The 
Linux kernel, the libraries used by many packages, the shells used to interpret 
commands, the X Window System GUI, the servers, and more all make up the 
system's software environment. Many of the chapters in this book are devoted to 
configuring specific software components, but they all have something in 
common: tools used to install, uninstall, upgrade, and otherwise manipulate the 
software. 


Ironically, this commonality is a major source of differences between Linux 
systems. Two major Linux package management tools exist: RPM Package 
Manager (RPM) and Debian. (Several less-common package management 
systems also exist.) With few exceptions, each individual Linux computer uses 
precisely one package management system, so you'll need to know only one to 
administer a single system. To be truly fluent in all things Linux, though, you 
should at least be somewhat familiar with both of them. Thus this chapter 
describes both. 


This chapter also covers libraries—software components that can be used by 
many different programs. Libraries help reduce the disk space and memory 
requirements of complex programs, but they also require some attention. If that 
attention isn't given to them, they can cause problems by their absence or 
because of incompatibilities between them and their dependent software's 
versions. 


Package management, and in some sense library management, relates to 


programs as files on your hard disk. Once run, though, programs are dynamic 
entities. Linux provides tools to help you manage running programs (known as 
processes)—you can learn what processes are running, change their priorities, 
and terminate processes that you don't want running. 


Package Concepts 


Before proceeding, you should understand some of the principles that underlie 
Linux package management tools. Any computer's software is like a house of 
cards: One program may rely on multiple other programs or libraries, each of 
which relies on several more, and so on. The foundation upon which all of these 
programs rely is the Linux kernel. Any of these packages can theoretically be 
replaced by an equivalent one; however, doing so sometimes causes problems. 
Worse still, removing one card from the stack could cause the whole house of 
cards to come tumbling down. 


Linux package management tools are intended to help build and modify this 
house of cards by tracking what software is installed. The information that the 
system maintains helps to avoid problems in several ways: 


Packages 


The most basic information that package systems maintain is information 
about software packages—that is, collections of files that are installed on 
the computer. Packages are usually distributed as single files that are 
similar to tarballs (archives created with the tar utility and usually 
compressed with gzip or bzip2) or zip files. Once installed, most packages 
consist of dozens or hundreds of files, and the package system tracks them 
all. Packages include additional information that aids in the subsequent 
duties of package management systems. 


Installed File Database 


Package systems maintain a database of installed files. The database 
includes information about every file installed via the package system, the 
name of the package to which each of those files belongs, and associated 
additional information. 


Dependencies 


One of the most important types of information maintained by the package 
system is dependency information—that is, the requirements of packages 
for one another. For instance, if SuperProg relies on UltraLib to do its work, 
the package database records this information. If you attempt to install 
SuperProg when UltraLib isn't installed, the package system won't let you 
do so. Similarly, if you try to uninstall UltraLib when SuperProg is 


installed, the package system won't let you. (You can override these 
prohibitions, as described later in “Forcing the Installation.” Doing so is 
usually inadvisable, though.) 


Checksums 


The package system maintains checksums and assorted ancillary 
information about files. This information can be used to verify the validity 
of the installed software. This feature has its limits, though; it's intended to 
help you spot disk errors, accidental overwriting of files, or other non- 
sinister problems. It's of limited use in detecting intrusions because an 
intruder could use the package system to install altered system software. 


Upgrades and Uninstallation 


By tracking files and dependencies, package systems permit easy upgrades 
and uninstallation: Tell the package system to upgrade or remove a 
package, and it will replace or remove every file in the package. Of course, 
this assumes that the upgrade or uninstallation doesn't cause dependency 
problems; if it does, the package system will block the operation unless you 
override it. 


Binary Package Creation 


Both the RPM and Debian package systems provide tools to help create 
binary packages (those that are installed directly) from source code. This 
feature is particularly helpful if you're running Linux on a peculiar CPU: 
you can download source code and create a binary package, even if the 
developers didn't provide explicit support for your CPU. Creating a binary 
package from source has advantages over compiling software from source 
in more conventional ways, because you can then use the package 
management system to track dependencies, attend to individual files, and so 
on. 


Both the RPM and Debian package systems provide all of these basic features, 
although the details of their operation differ. These two package systems are 
incompatible with one another in the sense that their package files and their 
installed file databases are different; that is, you can't directly install an RPM 
package on a Debian-based system or vice versa. (Tools to convert between 
formats do exist, and developers are working on ways to integrate the two 
package formats better.) 
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Most distributions install just one package system. It's possible to install 
more than one, though, and some programs (such as alien) require both for 
full functionality. Actually using both systems to install software is 
inadvisable because their databases are separate. If you install a library using 
a Debian package and then try to install an RPM package that relies on that 


library, RPM won't realize that the library is already installed and will return 
an error. 


Using RPM 


The most popular package manager in the Linux world is the RPM Package 
Manager (RPM). RPM is also available on non-Linux platforms, although it sees 
less use outside the Linux world. The RPM system provides all of the basic tools 
described in the preceding section, “Package Concepts,” such as a package 
database that allows for identifying conflicts and ownership of particular files. 


RPM Distributions and Conventions 


Red Hat developed RPM for its own distribution. Red Hat released the software 
under the General Public License (GPL), however, so that others are free to use 
it in their own distributions—and this is precisely what has happened. Some 
distributions, such as Mandriva (formerly Mandrake) and Yellow Dog, are based 
on Red Hat, so they use RPMs as well as many other parts of the Red Hat 
distribution. Others, such as SUSE, borrow less from the Red Hat template, but 
they do use RPMs. Of course, all Linux distributions share many common 
components, so even those that weren't originally based on Red Hat are very 
similar to it in many ways other than their use of RPM packages. On the other 
hand, distributions that were originally based on Red Hat have diverged from it 
over time. As a result, the group of RPM-using distributions shows substantial 
variability, but all of them are still Linux distributions that provide the same 
basic tools, such as the Linux kernel, common shells, an X server, and so on. 
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Red Hat has splintered into three distributions: Fedora is the downloadable 
version favored by home users, students, and businesses on a tight budget. 
The Red Hat name is now reserved for the for-pay version of the 
distribution, known more formally as Red Hat Enterprise Linux (RHEL). 
CentOS is a freely redistributable version intended for enterprise users. 


RPM is a cross-platform tool. As noted earlier, some non-Linux Unix systems 
can use RPM, although most don't use it as their primary package-distribution 
system. RPM supports any CPU architecture. Red Hat Linux is or has been 
available for at least five CPUs: x86, x86-64 (aka AMD64, EM64T, and x64), 
IA-64, Alpha, and SPARC. Among the distributions mentioned earlier, Pidora is 
an ARM processor distribution. (It runs on the popular Raspberry Pi device.) and 
SUSE is available on x86, x86-64, and PowerPC systems. For the most part, 
source RPMs are transportable across architectures—you can use the same 
source RPM to build packages for x86, AMD64, PowerPC, ARM, SPARC, or 
any other platform you like. Some programs are composed of architecture- 
independent scripts and so need no recompilation. There are also documentation 
and configuration packages that work on any CPU. 


The convention for naming RPM packages is as follows: 


packagename-a.b.c-x.arch. rpm 


Each of the filename components has a specific meaning: 
Package Name 


The first component (packagename) is the name of the package, such as 
samba or samba-server for the Samba file and print server. Note that the 
same program may be given different package names by different 
distribution maintainers. 


Version Number 


The second component (a.b.c) is the package version number, such as 
3.6.5. The version number doesn't have to be three numbers separated by 


periods, but that's the most common form. The program author assigns the 
version number. 


Build Number 


The number following the version number (x) is the build number (also 
known as the release number). This number represents minor changes made 
by the package maintainer, not by the program author. These changes may 
represent altered startup scripts or configuration files, changed file 
locations, added documentation, or patches appended to the original 
program to fix bugs or to make the program more compatible with the 
target Linux distribution. Many distribution maintainers add a letter code to 
the build number to distinguish their packages from those of others. Note 
that these numbers are not comparable across package maintainers— 
George's build number 5 of a package is not necessarily an improvement on 
Susan's build number 4 of the same package. 


Architecture 


The final component preceding the . rpm extension (arch) is a code for the 
package's architecture. The i386 architecture code is common; it represents 
a file compiled for any x86 CPU from the 80386 onward. Some packages 
include optimizations for Pentiums or newer (i586 or i686), and non-x86 
binary packages use codes for their CPUs, such as ppc for PowerPC CPUs 
or x86_64 for the x86-64 platform. Scripts, documentation, and other CPU- 
independent packages generally use the noarch architecture code. The main 
exception to this rule is source RPMs, which use the src architecture code. 


As an example of RPM version numbering, the Fedora 20 distribution for x86-64 
ships with a Samba package called samba-4.1.9-4.fc20.x86_64.rpm, 
indicating that this is build 4.fc20 of Samba 4.1.9, compiled with x86-64 
optimizations. These naming conventions are just that, though—conventions. It's 
possible to rename a package however you like, and it will still install and work. 
The information in the filename is retained within the package. This fact can be 
useful if you're ever forced to transfer RPMs using a medium that doesn't allow 
for long filenames. In fact, early versions of SUSE eschewed long filenames, 
preferring short filenames such as samba. rpm. 


In an ideal world, any RPM package will install and run on any RPM-based 
distribution that uses an appropriate CPU type. Unfortunately, compatibility 
issues can crop up from time to time, including the following: 


e Distributions may use different versions of the RPM utilities. This problem 


can completely prevent an RPM from one distribution from being used on 
another. 


e An RPM package designed for one distribution may have dependencies that 
are unmet in another distribution. A package may require a newer version 
of a library than is present on the distribution you're using, for instance. 
You can usually overcome this problem by installing or upgrading the 
package dependencies, but sometimes doing so causes problems because 
the upgrade may break other packages. By rebuilding the package you want 
to install from a source RPM, you can often work around these problems, 
but sometimes the underlying source code also needs the upgraded libraries. 


e An RPM package may be built to depend on a package of a particular 
name, such as samba-client depending on samba-common, but if the 
distribution you're using has named the package differently, the rpm utility 
will object. You can override this objection by using the --nodeps switch, 
but sometimes the package won't work once installed. Rebuilding from a 
source RPM may or may not fix this problem. 


e Even when a dependency appears to be met, different distributions may 
include slightly different files in their packages. For this reason, a package 
meant for one distribution may not run correctly when installed on another 
distribution. Sometimes installing an additional package will fix this 
problem. 


e Some programs include distribution-specific scripts or configuration files. 
This problem is particularly acute for servers, which may include startup 
scripts that go in etcrc.d/init.d or elsewhere. Overcoming this problem 
usually requires that you remove the offending script after installing the 
RPM and either start the server in some other way or write a new startup 
script, perhaps modeled after one that came with some other server for your 
distribution. 


In most cases, it's best to use the RPMs intended for your distribution. RPM 
meta-packagers, such as the Yellow Dog Updater, Modified (Yum), can simplify 
locating and installing packages designed for your distribution. If you're forced 
to go outside of your distribution's officially supported list of packages, mixing 
and matching RPMs from different distributions usually works reasonably well 
for most programs. This is particularly true if the distributions are closely related 
or you rebuild from a source RPM. If you have trouble with an RPM, though, 
you may do well to try to find an equivalent package that was built with your 
distribution in mind. 


The rpm Command Set 


The main RPM utility program is known as rpm. Use this program to install or 
upgrade a package at the shell prompt. The rpm command has the following 
syntax: 


rpm [operation][options] [package-files|packagenames ] 


Table 2.1 summarizes the most common rpm operations, and Table 2.2 
summarizes the most important options. Be aware, however, that rpm is a 
complex tool, so this listing is necessarily incomplete. For information about 
operations and options more obscure than those listed in Table 2.1 and Table 2.2, 
see the man pages for rpm. Many of rpm's less-used features are devoted to the 
creation of RPM packages by software developers. 


Table 2.1 Most important rpm options 


Option Used with Description 
operations 


--root Any Modifies the Linux system having a root directory 

dir located at dir. This option can be used to maintain one 
Linux installation discrete from another one (say, during 
OS installation or emergency maintenance). 


--force -i,-U,-F Forces installation of a package even when it means 
overwriting existing files or packages. 


-hor -- -i, -U, -F Displays a series of hash marks (#) to indicate the 
hash progress of the operation. 
-V -i, -U, -F Used in conjunction with the -h option to produce a 


uniform number of hash marks for each package. 


--nodeps -i, -U, -F, Specifies that no dependency checks be performed. 
-e Installs or removes the package even if it relies on a 
package or file that's not present or is required by a 
package that's not being uninstalled. 


--test |-i, -U,-F Checks for dependencies, conflicts, and other problems 
without actually installing the package. 


--prefix -i, -U, -F Sets the installation directory to path (works only for 
path some packages). 


-p 
package- 
file 


-i 
-ROT -- 
requires 


-lor -- 
list 


-q, -V Queries or verifies all packages. 

-q, -V Queries or verifies the package that owns file. 

-q Queries the uninstalled RPM package-file. 

-q Displays package information, including the package 
maintainer, a short description, and so on. 

-q Displays the packages and files on which this one 
depends. 

-q Displays the files contained in the package. 


Table 2.2 Common rpm operations 


Operation Description 


-i 


-U 


-F OF -- 
freshen 


-q 
-VOT -- 
verify 
-e 


-b 


--rebuild 


rebuilddb 


To use rpm, 


Installs a package; system must not contain a package of the same 
name 


Installs a new package or upgrades an existing one 


Upgrades a package only if an earlier version already exists 


Queries a package— finds whether a package is installed, what files 
it contains, and so on 


Verifies a package—checks that its files are present and unchanged 
since installation 


Uninstalls a package 


Builds a binary package, given source code and configuration files; 
moved to the rpmbuild program with RPM version 4.2 


Builds a binary package, given a source RPM file; moved to the 
rpmbuild program with RPM version 4.2 


Rebuilds the RPM database to fix errors 


you combine one operation with one or more options. In most cases, 


you include one or more package names or package filenames as well. (A 
package filename is a complete filename, but a package name is a shortened 
version. For instance, a package filename might be samba-4.1.9- 
4.fc20.x86_64.rpm, whereas the matching package name is samba.) You can 
issue the rpm command once for each package, or you can list multiple packages, 
separated by spaces, on the command line. The latter is often preferable when 
you're installing or removing several packages, some of which depend on others 
in the group. Issuing separate commands in this situation requires that you install 
the depended-on package first or remove it last, whereas issuing a single 
command allows you to list the packages on the command line in any order. 


Some operations require that you give a package filename, and others require a 
package name. In particular, -i, -U, -F, and the rebuild operations require 
package filenames; -q, -V, and -e normally take a package name, although the - 
p option can modify a query (-q) operation to work on a package filename. 


When your'e installing or upgrading a package, the -u operation is generally the 
most useful because it enables you to install the package without manually 
uninstalling the old one. This one-step operation is particularly helpful when 
packages contain many dependencies; rpm detects these and can perform the 
operation should the new package fulfill the dependencies provided by the old 
one. 


To use rpm to install or upgrade a package from an RPM file that you have 
already downloaded to your local system, issue a command similar to the 
following: 


# rpm -Uvh samba-4.1.9-4.fc20.x86_64.rpm 


You can also use rpm -ivh in place of rpm -Uvh if you don't already have a 
samba package installed. 
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It's possible to distribute the same program under different names. In this 
situation, upgrading may fail or it may produce a duplicate installation, 
which can yield bizarre program-specific malfunctions. Red Hat has 
described a formal system for package naming to avoid such problems, but 
they still occur occasionally. Therefore, it's best to upgrade a package using 


a subsequent release provided by the same individual or organization that 
provided the original. 


Verify that the package is installed with the rpm -qi command, which displays 
information such as when and on what computer the binary package was built. 
Listing 2.1 demonstrates this command. (rpm -qi also displays an extended 
plain-English summary of what the package is, which has been omitted from 


Listing 2.1.) 


Listing 2.1: RPM query output 


$ rpm -qi samba 
Name : samba 
Epoch 2 
Version : 4.1.9 
Release : 4.fc20 
Architecture: x86_64 
Install Date: Tue 02 Sep 2014 01:02:33 AM EDT 
Group : System Environment/Daemons 
Size : 1699739 
License : GPLv3+ and LGPLv3+ 
Signature : RSA/SHA256, Sat 02 Aug 2014 12:05:26 PM EDT, Key 
ID 
2eb161fa246110c1 
Source RPM : samba-4.1.9-4.fc20.src.rpm 
Build Date : Fri 01 Aug 2014 05:51:43 PM EDT 
Build Host : buildvm-10.phx2.fedoraproject.org 
Relocations : (not relocatable) 
Packager : Fedora Project 
Vendor : Fedora Project 
URL : http://www.samba.org/ 





Summary : Server and Client software to interoperate with 
Windows machines 

Description 

Samba is the standard Windows interoperability suite of programs 
for 


Linux and Unix. 





Extracting Data from RPMs 


Occasionally you may want to extract data from RPMs without installing the 
package. For instance, this can be a good way to retrieve the original source code 
from a source RPM for compiling the software without the help of the RPM 
tools or to retrieve fonts or other non-program data for use on a non-RPM 
system. 


RPM files are actually modified cpio archives. Thus, converting the files into 
cpio files is relatively straightforward, whereupon you can use cpio to retrieve 
the individual files. To do this job, you need to use the rpm2cpio program that 
ships with most Linux distributions. (You can even use this tool on distributions 
that don't use RPM.) This program takes a single argument—the name of the 
RPM file—and outputs the cpio archive on standard output. Thus, if you want to 
create a cpio archive file, you must redirect the output: 


$ rpm2cpio samba-4.1.9-4.fc20.src.rpm > samba-4.1.9-4.fc20.src.cpio 
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The redirection operator (>) is described in more detail in Chapter 1, 
“Exploring Linux Command-Line Tools,” as is the pipe operator (|), which 
is mentioned shortly. Chapter 4, “Managing Files,” describes cpio in more 
detail. 


You can then extract the data using cpio, which takes the -i option to extract an 


archive and --make-directories to create directories: $ cpio -i --make- 
directories < samba-4.1.9-4.fc20.src.cpio 


Alternatively, you can use a pipe to link these two commands together without 
creating an intermediary file: 


$ rpm2cpio samba-4.1.9-4.fc20.src.rpm | cpio -i --make-directories 


In either case, the result is an extraction of the files in the archive in the current 
directory. In the case of binary packages, this is likely to be a series of 
subdirectories that mimic the layout of the Linux root directory—that is, usr, 
lib, etc, and so on, although precisely which directories are included depends 
on the package. For a source package, the result of the extraction process is 
likely to be a source code tarball, a . spec file (which holds information that 
RPM uses to build the package), and perhaps some patch files. 
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When you're extracting data from an RPM file using rpm2cpio and cpio, 
create a holding subdirectory and then extract the data into this subdirectory. 
This practice will ensure that you can find all of the files. If you extract files 
in your home directory, some of them may get lost among your other files. If 
you extract files as root in the root (/) directory, they could conceivably 
overwrite files that you want to keep. 


Another option for extracting data from RPMs is to use alien, which is 
described later in “Converting between Package Formats.” This program can 
convert an RPM into a Debian package or a tarball. 


Using Yum 


Yum (http://yum.baseurl.org), mentioned earlier, is one of several meta- 
packagers—it enables you to install a package and all its dependencies easily 
using a single command line. When using Yum, you don't even need to locate 
and download the package files because Yum does this for you by searching in 
one or more repositories—Internet sites that host RPM files for a particular 
distribution. 


Yum originated with the fairly obscure Yellow Dog Linux distribution, but it's 
since been adopted by Red Hat, CentOS, Fedora, and some other RPM-based 
distributions. Yum isn't used by all RPM-based distributions, though; SUSE and 
Mandriva, to name just two, each uses their own meta-packager. Debian-based 
distributions generally employ the Advanced Package Tools (APT), as described 
later in “Using apt-get.” Nonetheless, because of the popularity of Red Hat, 
CentOS, and Fedora, knowing Yum can be valuable. 


The most basic way to use Yum is with the yum command, which has the 
following syntax: 


yum [options] [command] [package...] 


Which options are available depend on the command you use. ‘Table 2.3 
describes common yum commands. 


Table 2.3 Common yum commands 


Command 


install 


update 


check-update 


upgrade 


remove or 
erase 
list 


provides or 
whatprovides 


search 


info 


clean 


shell 


resolvedep 


Description 


Installs one or more packages by package name. Also installs 
dependencies of the specified package or packages. 


Updates the specified package or packages to the latest available 
version. If no packages are specified, yum updates every 
installed package. 


Checks to see whether updates are available. If they are, yum 
displays their names, versions, and repository area (updates or 
extras, for instance). 


Works like update with the --obsoletes flag set, which 
handles obsolete packages in a way that's superior when 
performing a distribution version upgrade. 


Deletes a package from the system; similar to rpm -e, but yum 
also removes depended-on packages. 


Displays information about a package, such as the installed 
version and whether an update is available. 


Displays information about packages that provide a specified 
program or feature. For instance, typing yum provides samba 
lists all the Samba-related packages, including every available 
update. Note that the output can be copious. 


Searches package names, summaries, packagers, and 
descriptions for a specified keyword. This is useful if you don't 
know a package's name but can think of a word that's likely to 
appear in one of these fields but not in these fields for other 
packages. 


Displays information about a package, similar to the rpm -qi 
command. 


Cleans up the Yum cache directory. Running this command 
from time to time is advisable, lest downloaded packages chew 
up too much disk space. 


Enters the Yum shell mode, in which you can enter multiple 
Yum commands one after another. 


Displays packages matching the specified dependency. 


localinstall Installs the specified local RPM files, using your Yum 
repositories to resolve dependencies. 


localupdate Updates the system using the specified local RPM files, using 
your Yum repositories to resolve dependencies. Packages other 
than those updated by local files and their dependencies are not 
updated. 


deplist Displays dependencies of the specified package. 


In most cases, using Yum is easier than using RPM directly to manage packages 
because Yum finds the latest available package, downloads it, and installs any 
required dependencies. Yum has its limits, though; it's only as good as its 
repositories, so it can't install software that's not stored in those repositories. 
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If you use Yum to upgrade all packages automatically on your system, 
you're effectively giving control of your system to the distribution 
maintainer. Although Red Hat or other distribution maintainers are unlikely 
to try to break into your computer in this way, an automatic update with 
minimal supervision on your part could easily break something on your 
system, particularly if you've obtained packages from unusual sources in the 
past. 


If you don't want to install the package but merely want to obtain it, you can use 
yumdownloader. Type this command followed by the name of a package and the 
latest version of the package will be downloaded to the current directory. This 
can be handy if you need to update a system that's not connected to the Internet; 
you can use another computer that runs the same distribution to obtain the 
packages and then transfer them to the target system. 


If you prefer to use GUI tools rather than command-line tools, you should be 
aware that GUI front-ends to yum exist. Examples include yumex and kyum. You 
can use the text-mode yun to install these front-ends, as in yum install kyum. 


Exercise 2.1 runs you through the process of managing packages using the rpm 
utility. 


Exercise 2.1 
Managing Packages Using RPM 


To manage packages using the rpm utility, follow these steps: 
1. Log into the Linux system as a normal user. 


2. Acquire a package to use for testing purposes. You can try using a 
package from your distribution that you know you haven't installed, but 
if you try a random package, you may find that it's already installed or 
has unmet dependencies. As an example, this lab uses the installation of 
zsh-5.0.6-1.fc20.x86_64.rpm, a shell that's not installed by default 
on most systems, from the Fedora 20 DVD onto a Fedora 20 system. 





You must adjust the commands as necessary if you use another RPM 
file in your tests. 


3. Launch an xterm from the desktop environment's menu system if you 


used a GUI login. 


4. Acquire root privileges. You can do this by typing su in an xterm, by 
selecting Session > New Root Console from a Konsole window, or by 
using sudo (if it's configured) to run the commands in the following 


steps. 


5.Type rpm -q zsh to verify that the package isn't currently installed. The 
system should respond with the message package zsh is not 
installed. 


6. Type rpm -qpi zsh-5.0.6-1.fc20.x86_64.rpm. (You'll need to 
provide a complete path to the package file if it's not in your current 
directory.) The system should respond by displaying information about 
the package, such as the version number, the vendor, the hostname of 
the machine on which it was built, and a package description. 


. Type rpm -ivh zsh-5.0.6-1.fc20.x86_64.rpm. The system should 
install the package and display a series of hash marks (#) as it does so. 


. Type rpm -q zsh. The system should respond with the complete 
package name, including the version and build numbers. This response 
verifies that the package is installed. 


. Type zsh. This launches a Z shell, which functions much like the more 
common bash and tcsh shells. You're likely to see your command 
prompt change, but you can issue most of the same commands you can 
use with bash or tcsh. 


10. Type rpm -v zsh. The system shouldn't produce any output—just a 
new command prompt. The verify (-v or -- verify) command checks 
the package files against data stored in the database. Immediately after 
installation, most packages should show no deviations. (A handful of 
packages will be modified during installation, but zsh isn't one of 
them.) 


11. Type rpm -e zsh. The system shouldn't produce any output—just a 
new command prompt. This command removes the package from the 
system. Note that you're removing the zsh package while running the 
zsh program. Linux continues to run the zsh program you're using, but 


you'll be unable to launch new instances of the program. Some 
programs may misbehave if you do this because files will be missing 
after you remove the package. 


12. Type exit to exit zsh and return to your normal shell. 


13. Type rpm -q zsh. The system should respond with a package zsh is 
not installed error because you've just uninstalled the package. 


14. Type yum install zsh. The system should check your repositories, 
download zsh, and install it. It will ask for confirmation before 
beginning the download. 


15. Type rpm -q zsh. The results should be similar to those in step 8, 
although the version number may differ. 


16. Type rpm -e zsh. This step removes zsh from the system but 
produces no output, just as in step 11. 


The final three steps will work only if your distribution uses Yum. If you're 
using a distribution that uses another tool, you may be able to locate and use 
its equivalent, such as zypper for SUSE. 





RPM and Yum Configuration Files 


Ordinarily, you needn't explicitly configure RPM or Yum; distributions that use 
RPM configure it in reasonable ways by default. Sometimes, though, you may 
want to tweak a few details, particularly if you routinely build source RPM 
packages and want to optimize the output for your computer. You may also want 
to add a Yum repository for some unusual software you run. To do so, you 
typically edit an RPM or Yum configuration file. 


The main RPM configuration file is usrlib/rpm/rpmrc. This file sets a variety 
of options, mostly related to the CPU optimizations used when compiling source 
packages. You shouldn't edit this file, though; instead, you should create and edit 
etcrpmrc (to make global changes) or ~/. rpmrc (to make changes on a per-user 
basis). The main reason to create such a file is to implement architecture 
optimizations—for instance, to optimize your code for your CPU model by 
passing appropriate compiler options when you build a source RPM into a binary 
RPM. This is done with the optflags line: 


optflags: athlon -02 -g -march=i686 


This line tells RPM to pass the -02 -g -march-i686 options to the compiler 
whenever it's building for the athlon platform. Although RPM can determine 
your system's architecture, the opt flags line by itself isn't likely to be enough to 
set the correct flags. Most default rpmrc files include a series of 
buildarchtranslate lines that cause rpmbuild (or rpm for older versions of 
RPM) to use one set of optimizations for a whole family of CPUs. For x86 
systems, these lines typically look like this: 


buildarchtranslate: athlon: i386 
buildarchtranslate: i686: i386 
buildarchtranslate: i586: i386 
buildarchtranslate: i486: i386 
buildarchtranslate: i386: i386 


These lines tell RPM to translate the athlon, i686, i586, i486, and i386 CPU 
codes to use the i386 optimizations. This effectively defeats the purpose of any 
CPU-specific optimizations you create on the optflags line for your 
architecture, but it guarantees that the RPMs you build will be maximally 
portable. To change matters, you must alter the line for your CPU type, as 
returned when you type uname -p. For instance, on an Athlon-based system, you 
might enter the following line: 


buildarchtranslate: athlon: athlon 


Thereafter, when you rebuild a source RPM, the system will use the appropriate 
Athlon optimizations. The result can be a slight performance boost on your own 
system but reduced portability—depending on the precise optimizations you 
choose, such packages may not run on non-Athlon CPUs. (Indeed, you may not 
even be able to install them on non-Athlon CPUs!) 


Yum is configured via the etcyum. conf file, with additional configuration files 
in the etcyum. repos .d/ directory. The yum. conf file holds basic options, such 
as the directory to which Yum downloads RPMs and where Yum logs its 
activities. Chances are that you won't need to modify this file. The 
etcyum.repos.d/ directory, on the other hand, potentially holds several files, 
each of which describes a Yum repository—that is, a site that holds RPMs that 
may be installed via Yum. You probably shouldn't directly edit these files; 
instead, if you want to add a repository, you should manually download the 
RPM that includes the repository configuration and install it using rpm. The next 
time you use Yum, it will access your new repository along with the old ones. 
Several Yum repositories exist, mostly for Red Hat, CentOS, and Fedora, such 


as the following: 
Livna 


This repository (http://rpm.livna.org/) hosts multimedia tools, such as 
additional codecs and video drivers. 


KDE Red Hat 


Red Hat, CentOS, and Fedora favor the GNU Network Object Model 
Environment (GNOME) desktop environment, although they ship with the 
K Desktop Environment (KDE) too. The repository at http: //kde- 
redhat .sourceforge.net provides improved KDE RPMs for those who 
favor KDE. 


Fresh RPMs 


This repository (http://freshrpms.net) provides additional RPMs, mostly 
focusing on multimedia applications and drivers. 


Many additional repositories exist. Try a Web search on terms such as yum 
repository, or check the web page of any site that hosts unusual software that 
you want to run to see whether it provides a Yum repository. If so, it should 
provide an RPM or other instructions on adding its site to your Yum repository 
list. 


RPM Compared to Other Package Formats 


RPM is a very flexible package management system. In most respects, it's 
comparable to Debian's package manager, and it offers many more features than 
tarballs. When compared to Debian packages, the greatest strength of RPMs is 
probably their ubiquity. Many software packages are available in RPM form 
from their developers and/or from distribution maintainers. 


pm 


Distribution packagers frequently modify the original programs in order to 
make them integrate more smoothly into the distribution as a whole. For 
instance, distribution-specific startup scripts may be added, program binaries 
may be relocated from default usrlocal subdirectories, and program source 
code may be patched to fix bugs or add features. Although these changes can 
be useful, you may not want them, particularly if you're using a program on 
a distribution other than the one for which the package was intended. 


The fact that there are so many RPM-based distributions can be a boon. You 
may be able to use an RPM intended for one distribution on another, although, as 
noted earlier, this isn't certain. In fact, this advantage can turn into a drawback if 
you try to mix and match too much—you can wind up with a mishmash of 
conflicting packages that can be difficult to disentangle. 


A 


The RPMFind website, http://rpmfind.net, is an extremely useful 
resource when you want to find an RPM of a specific program. Another site 
with similar characteristics is Fresh RPMs, http://freshrpms.net. These 
sites include links to RPMs built by programs' authors, specific distributions' 
RPMs, and those built by third parties. Adding such sites as Yum 
repositories to your repository library can make it even easier to install new 
programs. 


Compared to tarballs, RPMs offer much more sophisticated package 
management tools. This can be important when you're upgrading or removing 
packages and also for verifying the integrity of installed packages. On the other 
hand, although RPMs are common in the Linux world, they're less common on 
other platforms. Therefore, you're more likely to find tarballs of generic Unix 
source code, and tarballs are preferred if you've written a program that you 
intend to distribute for other platforms. 


Using Debian Packages 


In their overall features, Debian packages are similar to RPMs, but the details of 
operation for each differ, and Debian packages are used on different distributions 
than are RPMs. Because each system uses its own database format, RPMs and 
Debian packages aren't interchangeable without converting formats. Using 
Debian packages requires knowing how to use the dpkg, dselect, and apt-get 
commands. A few other commands can also be helpful. 


Debian Distributions and Conventions 


As the name implies, Debian packages originated with the Debian distribution. 
Since that time, the format has been adopted by several other distributions, 
including Ubuntu, Linux Mint, and Xandros. Such distributions are derived from 
the original Debian, which means that packages from the original Debian are 
likely to work well on other Debian-based systems. Although Debian doesn't 
emphasize flashy GUI configuration tools, its derivatives tend to be more GUI- 
centric, which makes these distributions more appealing to Linux novices. The 
original Debian favors a system that's as bug free as possible, and it tries to 
adhere strictly to open-source software principles rather than invest effort in GUI 
configuration tools. The original Debian is unusual in that it's maintained not by 
a company that is motivated by profit but rather by volunteers who are motivated 
by the desire to build a product they want to use. 


Like RPM, the Debian package format is neutral with respect to both OS and 
CPU type. Debian packages are extremely rare outside Linux, although attempts 
to use various systems that used the Debian package system and software library 
atop non-Linux kernels have been made, and largely abandoned, with the 


exception of kFreeBSD (www. debian. org/ports/kfreebsd-gnu/). 


The original Debian distribution has been ported to many different CPUs, 
including x86, x86-64, IA-64, ARM, PowerPC, Alpha, 680x0, MIPS, and 
SPARC. The original architecture was x86, and subsequent ports exist at varying 
levels of maturity. Derivative distributions generally work only on x86 or x86-64 
systems, but this could change in the future. 


Debian packages follow a naming convention similar to that for RPMs, but 
Debian packages sometimes omit codes in the filename to specify a package's 
architecture, particularly on x86 packages. When these codes are present, they 
may differ from RPM conventions. For instance, a filename ending in i386.deb 


indicates an x86 binary, powerpc .deb is a PowerPC binary, and all.deb 
indicates a CPU-independent package, such as documentation or scripts. As with 
RPM files, this filenaming convention is only that—a convention. You can 
rename a file as you see fit, either to include or omit the processor code. There is 
no code for Debian source packages because, as described in the upcoming 
section “Debian Packages Compared to Other Package Formats,” Debian source 
packages consist of several separate files. 


The dpkg Command Set 


Debian packages are incompatible with RPM packages, but the basic principles 
of operation are the same across both package types. Like RPMs, Debian 
packages include dependency information, and the Debian package utilities 
maintain a database of installed packages, files, and so on. You use the dpkg 


command to install a Debian package. This command's syntax is similar to that 
of rpm: 


dpkg [options]|[action] [package-files|package-name] 


action is the action to be taken; common actions are summarized in Table 2.4. 


The options (Table 2.5) modify the behavior of the action, much like the options 
to rpm. 


Table 2.4 dpkg primary actions 


Action Description 

-i or --install Installs a package 

--configure Reconfigures an installed package: runs the post- 
installation script to set site-specific options 

-r or --remove Removes a package but leaves configuration files intact 

-P Or - -purge Removes a package, including configuration files 


--get-selections Displays currently installed packages 
-p or --print-avail Displays information about an installed package 
-I or --info Displays information about an uninstalled package file 


-1 pattern or -- Lists all installed packages whose names match pattern 
list pattern 


-Lor--listfiles Lists the installed files associated with a package 
-S pattern or -- Locates the package(s) that own the file(s) specified by 


search pattern 


-C or --audit 


pattern 


Searches for partially installed packages and suggests 
what to do with them 


Table 2.5 Options for fine-tuning dpkg actions 


Option 


--root=dir 


-B or --auto- 
deconfigure 


--force-things 


--ignore- 
depends=package 


--no-act 


--recursive 


-G 


-E or --skip- 
same-version 


Used 
with 


actions 


All 


Description 


Modifies the Linux system using a root directory 
located at dir. Can be used to maintain one Linux 
installation discrete from another one, say during 
OS installation or emergency maintenance. 


Disables packages that rely on one that is being 
removed. 


Assorted Overrides defaults that would ordinarily cause 


dpkg to abort. Consult the dpkg man page for details 
of what (specified by things) this option does. 


Ignores dependency information for the specified 
package. 


Checks for dependencies, conflicts, and other 
problems without actually installing or removing 
the package. 


Installs all packages that match the package-name 
wildcard in the specified directory and all 
subdirectories. 


Doesn't install the package if a newer version of 
the same package is already installed. 


Doesn't install the package if the same version of 
the package is already installed. 


As with rpm, dpkg expects a package name in some cases and a package 
filename in others. Specifically, - -install (-i) and - -info (-I) both require the 
package filename, but the other commands take the shorter package name. 


As an example, consider the following command, which installs the 
samba_4.1.6+dfsg-1ubuntu2.1404.3_amd64.deb package: 


# dpkg -i samba_4.1.6+dfsg-1ubuntu2.1404.3_amd64.deb 


If you're upgrading a package, you may need to remove an old package before 
installing the new one. To do this, use the -r option to dpkg, as in the following: 


# dpkg -r samba 


To find information about an installed package, use the -p parameter to dpkg, as 
shown in Listing 2.2. This listing omits an extended English description of what 
the package does. 


Listing 2.2: dpkg package information query output 


$ dpkg -p samba 

Package: samba 

Priority: optional 

Section: net 

Installed-Size: 11157 

Maintainer: Ubuntu Developers <ubuntu-devel- 
discuss@lists.ubuntu.com> 
Architecture: amd64 
Version: 2:4.1.6+dfsg-1ubuntu2.14.04.3 

Replaces: libsamdbO (<< 4.0.0~alphai7~), python-samba (<< 
2:4.1.4+dfsg-3), 

samba-ad-dc, samba-common (<= 2.0.5a-2), samba-doc (<< 
2:4.0.5~), samba-libs (<< 2:4.1.4+dfsg-2), samba4 

Depends: adduser, heimdal-hdb-api-8, libpam-modules, libpam- 
runtime (>= 

1.0.1-11), lsb-base (>= 4.1+Debian), procps, python (>= 2.7), 
python-dnspython, python-ntdb, python-samba, samba-common (= 
2:4.1.6+dfsg-1ubuntu2.14.04.3), samba-common-bin (= 
2:4.1.6+dfsg-lubuntu2.14.04.3), 
samba-dsdb-modules, tdb-tools, update-inetd, sysv-rc (>= 
2.88dsf-24) | 
file-rc (>= 0.8.16), python (<< 2.8), python2.7:any, libasn1-8- 
heimdal (>= 
1.4.0+git20110226), libbsd® (>= 0.5.0), libc6 (>= 2.14), 
libcomerr2 (>= 
1.01), libhdb9-heimdal (>= 1.4.0+git20110226), libkdc2-heimdal 
(>= 
1.4.0+git20110226), libkrb5-26-heimdal (>= 1.4.0+git20110226), 
libldb1 

(>= 0.9.21), libpoptO (>= 1.14), libpython2.7 (>= 2.7), 
libroken18-heimdal 

(>= 





1.4.0+git20110226), libtalloc2 (>= 2.0.4~git20101213), libtdb1 
(>= 

1.2.7+g91t20101214), libteventO (>= 0.9.14), samba-libs (= 
2:4.1.6+dfsg-1ubuntu2.14.04.3) 

Pre-Depends: dpkg (>= 1.15.6~), multiarch-support 

Recommends: attr, logrotate, samba-vfs-modules 

Suggests: bind9 (>= 1:9.5.1), bind9utils, ldb-tools, ntp, 
smbldap-tools, 

winbind, ufw 

Conflicts: libldb1 (<< 1:1.1.15), samba (<< 2:3.3.0~rc2-5), 
samba-ad-dc, 

samba-doc (<< 2:4.0.5~), samba-tools, samba4 (<< 4.0.0~alpha6-2) 
Enhances: bind9, ntp 

Size: 838626 





Debian-based systems often use a pair of somewhat higher-level utilities, apt - 
get and dselect, to handle package installation and removal. These utilities are 
described later in “Using apt-get” and “Using dselect, aptitude, and 
Synaptic.” Their interfaces can be very useful when you want to install several 
packages, but dpkg is often more convenient when you're manipulating just one 
or two packages. Because dpkg can take package filenames as input, it's also the 
preferred method of installing a package that you download from an unusual 
source or create yourself. 


Using apt-cache 


The APT suite of tools includes a program, apt -cache, that's intended solely to 
provide information about the Debian package database (known in Debian 
terminology as the package cache). You may be interested in using several 
features of this tool: 


Display Package Information 


Using the showpkg subcommand, as in apt-cache showpkg samba, displays 
information about the package. The information displayed is different from 
that returned by dpkg's informational actions. 


Display Package Statistics 


You can learn how many packages you've installed, how many 
dependencies are recorded, and various other statistics about the package 
database by passing the stats subcommand, as in apt-cache stats. 


Find Unmet Dependencies 


If a program is reporting missing libraries or files, typing apt-cache unmet 
may help; this function of apt-cache returns information about unmet 
dependencies, which may help you track down the source of missing-file 
problems. 


Display Dependencies 


Using the depends subcommand, as in apt-cache depends samba, shows 
all of the specified package's dependencies. This information can be helpful 
in tracking down dependency-related problems. The rdepends 
subcommand finds reverse dependencies—packages that depend on the one 
you specify. 


Locate All Packages 


The pkgnames subcommand displays the names of all the packages installed 
on the system. If you include a second parameter, as in apt-cache 
pkgnames sa, the program returns only those packages that begin with the 
specified string. 


Several more subcommands and options exist, but these are the ones you're most 
likely to use. Several apt -cache subcommands are intended for package 
maintainers and debugging serious package database problems rather than day- 
to-day system administration. Consult the man page for apt-cache for more 
information. 


Using apt-get 


APT, with its apt-get utility, is Debian's equivalent to Yum on certain RPM- 
based distributions. This meta-packaging tool lets you perform easy upgrades of 
packages, especially if you have a fast Internet connection. Debian-based 
systems include a file, etcapt/sources. list, that specifies locations from 
which important packages can be obtained. If you installed the OS from a CD- 
ROM drive, this file will initially list directories on the installation CD-ROM in 
which packages can be found. There are also likely to be a few lines near the top, 
commented out with hash marks (#), indicating directories on an FTP site or a 
website from which you can obtain updated packages. (These lines may be 
uncommented if you did a network install initially.) 


ghi 
ING 
Don't add a site to etcapt/sources .list unless you're sure it can be trusted. 
The apt -get utility does automatic and semiautomatic upgrades, so if you 
add a network source to sources.list and that source contains unreliable 


programs or programs with security holes, your system will become 
vulnerable after upgrading via apt-get. 


Although APT is most strongly associated with Debian systems, a port to RPM- 
based systems is also available. Check http://apt4rpm.sourceforge.net for 
information about this port. 


The apt-get utility works by obtaining information about available packages 
from the sources listed in etcapt/sources.1list and then using that information 
to upgrade or install packages. The syntax is similar to that of dpkg: 


apt-get [options][command] [package-names] 


Table 2.6 lists the apt-get commands, and Table 2.7 lists the most commonly 
used options. In most cases, you won't use any options with apt - get—just a 
single command and possibly one or more package names. One particularly 
common use of this utility is to keep your system up-to-date with any new 
packages. The following two commands will accomplish this goal if 
etcapt/sources.list includes pointers to up-to-date file archive sites: 


# apt-get update 
# apt-get dist-upgrade 


ghi 
ING 


If you use APT to upgrade all packages on your system automatically, you're 
effectively giving control of your computer to the distribution maintainer. 
Although Debian or other distribution maintainers are unlikely to try to 
break into your computer in this way, an automatic update with minimal 
supervision on your part could easily break something on your system, 
particularly if you've obtained packages from unusual sources in the past. 


Table 2.7 Most-useful apt-get options 


Option 


-d or - -download- 
only 


-f or --fix-broken 


-m, --ignore- 
missing, Or --fix- 
missing 


-q Or - -quiet 


-S, --Simulate, -- 
just-print, --dry- 
run, --recon, OF -- 
no-act 


-y, --yes, OF - - 
assume-yes 


Used with 
commands 
upgrade, 
dselect - 
upgrade, 
install, source 


install, remove 


upgrade, 
dselect- 


upgrade, 
install, 
remove, source 


All 


All 


All 


Description 


Downloads package files but doesn't 
install them. 


Attempts to fix a system on which 
dependencies are unsatisfied. 


Ignores all package files that can't be 
retrieved (because of network errors, 
missing files, or the like). 


Omits some progress indicator 
information. May be doubled (for 
instance, -qq) to produce still less 
progress information. 


Performs a simulation of the action 
without actually modifying, installing, 
or removing files. 


Produces a `yes" response to any 
yes/no prompt in installation scripts. 


-b, --compile, or -- source Compiles a source package after 


build 


retrieving it. 


--no-upgrade install Causes apt-get to not upgrade a 


package if an older version is already 
installed. 


Table 2.6 apt-get commands 


Command Description 


update 
upgrade 
dselect - 


upgrade 


dist - 
upgrade 


install 


remove 


source 


check 


clean 


autoclean 


Obtains updated information about packages available from the 
installation sources listed in etcapt/sources. list. 


Upgrades all installed packages to the newest versions available, 
based on locally stored information about available packages. 


Performs any changes in package status (installation, removal, and 
so on) left undone after running dselect. 


Similar to upgrade, but performs “smart” conflict resolution to 
avoid upgrading a package if doing so would break a dependency. 


Installs a package by package name (not by package filename), 
obtaining the package from the source that contains the most up-to- 
date version. 


Removes a specified package by package name. 


Retrieves the newest available source package file by package 
filename using information about available packages and 
installation archives listed in etcapt/sources. list. 


Checks the package database for consistency and broken package 
installations. 


Performs housekeeping to help clear out information about 
retrieved files from the Debian package database. If you don't use 
dselect for package management, run this from time to time in 
order to save disk space. 


Similar to clean, but removes information only about packages that 
can no longer be downloaded. 


In Exercise 2.2, you'll familiarize yourself with the Debian package system. 


Exercise 2.2 


Managing Debian Packages 


To manage Debian packages, follow these steps: 
1. Log into the Linux system as a normal user. 


2. Acquire a package to use for testing purposes. You can try using a 
package from your distribution that you know you haven't installed; if 
you try arandom package, however, you may find that it's already 
installed or has unmet dependencies. As an example, this lab uses the 
installation of zsh_5.0.2-3ubuntu6_amd64. deb, a shell that's not 
installed by default on most systems, obtained using the -d option to 
apt-get on an Ubuntu 14.04 system. You must adjust the commands as 


necessary if you use another package, distribution, or architecture in 
your tests. 


3. Launch an xterm from the desktop environment's menu system if you 
used a GUI login. 


4. Acquire root privileges. You can do this by typing su in an xterm, by 
selecting Session > New Root Console from a Konsole window, or by 


using sudo (if it's configured) to run the commands in the following 
steps. 


5. Type dpkg -L zsh to verify that the package isn't currently installed. 
This command responds with a list of files associated with the package 
if it's installed or with an error that reads Package 'zsh' is not 
installed if it's not. 


6. Type dpkg -I zsh_5.0.2-3ubuntu6_amd64.deb. (You'll need to adda 
complete path to the package file if it's not in your current directory.) 
The system should respond by displaying information about the 
package, such as the version number, dependencies, the name of the 
package maintainer, and a package description. 


7. Type dpkg -i zsh_5.0.2-3ubuntu6_amd64.deb. The system should 
install the package and display a series of lines summarizing its actions 
as it does so. 


8. Type dpkg -p zsh. The system should respond with information about 
the package similar to that displayed in step 6. 


9. Type zsh. This launches a Z shell, which functions much like the more 
common bash and tcsh shells. You're likely to see your command 


prompt change slightly, but you can issue most of the same commands 
that you can use with bash or tcsh. 


10. Type dpkg -P zsh. This command removes the package from the 
system, including configuration files. It may produce a series of 
warnings about non-empty directories that it couldn't remove. Note that 
you're removing the zsh package while running the zsh program. Linux 
continues to run the zsh program you're using, but you'll be unable to 
launch new instances of the program. Some programs may misbehave 
because files will be missing after you remove the package. 


11. Type exit to exit from zsh and return to your normal shell. 


12. Type dpkg -L zsh. The system should respond with a Package 'zsh' 
is not installed error, because you've just uninstalled it. 


13. Type apt-get install zsh to install zsh using the APT system. 
Depending on your configuration, the system may download the 
package from an Internet site or ask you to insert a CD-ROM. If it asks 
for a CD-ROM, insert it and press the Enter key. The system should 
install the package. 


14. Type dpkg -p zsh. The system should respond with information about 
the package similar to that displayed in step 6 or step 8. 


15. Type dpkg -P zsh. This command removes the package from the 
system, as described in step 10. 





Using dselect, aptitude, and Synaptic 


The dselect program is a high-level package browser. Using it, you can select 
packages to install on your system from the APT archives defined in 
etcapt/sources. list, review the packages that are already installed on your 
system, uninstall packages, and upgrade packages. Overall, dselect is a 
powerful tool, but it can be intimidating to the uninitiated because it presents a 
lot of options that aren't obvious, using a text-mode interactive user interface. 
Because of that, most Linux distributions don't install it by default. Nonetheless, 
it's well worth taking the time to install it and getting to know how to use it. 


Although dselect supports a few command-line options, they're mostly obscure 
or minor (such as options to set the color scheme). Consult dselect's man page 
for details. To use the program, type dselect. The result is the dselect main 
menu, as shown running in an Ubuntu desktop in Figure 2.1. 


rich@rich-VirtualBox: ~ 
Debian “dselect' package handling frontend version 1.17.5 (amd64). 


. [U]pdate Update List of available packages, if possible. 
[S]elect Request which packages you want on your system. 
{I]nstall Install and upgrade wanted packages. 

[C]jonfig Configure any packages that are unconfigured. 
[R]emove Remove unwanted software. 
[Q]juit Quit dselect. 


Move around with “P and “N, cursor keys, initial letters, or digits; 
Press <enter> to confirm selection. AL redraws screen. 


Copyright (C) 1994-1996 Ian Jackson. 

Copyright (C) 2000,2001 Wichert Akkerman. 

This is free software; see the GNU General Public License version 2 or 
later for copying conditions. There is NO warranty. 


Read-only access: only preview of selections is available! 





The dselect utility provides access to APT features using a menu 
system. 


Another text-based Debian package manager is aptitude. In interactive mode, 
aptitude is similar to dselect in a rough way, but aptitude adds menus 
accessed by pressing Ctrl+T and rearranges some features. You can also pass 
various commands to aptitude on the command line, as in aptitude search 
samba, which searches for packages related to Samba. Features accessible from 
the command line (or the interactive interface) include the following: 


Update Package Lists 


You can update package lists from the APT repositories by typing 
aptitude update. 


Install Software 


The install command-line option installs a named package. This 
command has several variant names and syntaxes that modify its action. For 
instance, typing aptitude install zsh installs the zsh package, but 
typing aptitude install zsh- (witha trailing dash) and aptitude 

remove zsh both uninstall zsh. 


Upgrade Software 


The full-upgrade and safe-upgrade options both upgrade all installed 
packages. The safe-upgrade option is conservative about removing 
packages or installing new ones and so may fail; full-upgrade is less 
conservative about these actions, and so it is more likely to complete its 
tasks. However, it may break software in the process. 


Search for Packages 


The search option, noted earlier, searches the database for packages 
matching the specified name. The result is a list of packages, one per line, 
with summary codes for each package's install status, its name, and a brief 
description. 


Clean Up the Database 


The autoclean option removes already-downloaded packages that are no 
longer available, and clean removes all downloaded packages. 


Obtain Help 
Typing aptitude help results in a complete list of options. 


Broadly speaking, aptitude combines the interactive features of dselect with 
the command-line options of apt-get. All three programs provide similar 
functionality, so you can use whichever one you prefer. 


A tool that's similar to dselect and aptitude in some ways is Synaptic, but 
Synaptic is a GUI X-based program and, as such, is easier to use. Overall, 
dselect, aptitude, and Synaptic are useful tools, particularly if you need to 
locate software but don't know its exact name—the ability to browse and search 
the available packages can be a great boon. Unfortunately, the huge package list 
can be intimidating. 


Reconfiguring Packages 


Debian packages often provide more-extensive initial setup options than do their 
RPM counterparts. Frequently, the install script included in the package asks a 
handful of questions, such as querying for the name of an outgoing mail relay 
system for a mail server program. These questions help the package system set 
up a standardized configuration that has nonetheless been customized for your 
computer. 


In the course of your system administration, you may alter the configuration files 


for a package. If you do this and find that you've made a mess of things, you 
may want to revert to the initial standard configuration. To do so, you can use 
the dpkg-reconfigure program, which runs the initial configuration script for 
the package you specify: 


# dpkg-reconfigure samba 


This command reconfigures the samba package, asking the package's initial 
installation questions and restarting the Samba daemons. Once this is done, the 
package should be in something closer to its initial state. 


Debian Packages Compared to Other Package Formats 


The overall functionality of Debian packages is similar to that of RPMs, 
although there are differences. Debian source packages aren't single files; they're 
groups of files—the original source tarball, a patch file that's used to modify the 
source code (including a file that controls the building of a Debian package), and 
a .dsc file that contains a digital “signature” to help verify the authenticity of the 
collection. The Debian package tools can combine these and compile the 
package to create a Debian binary package. This structure makes Debian source 
packages slightly less convenient to transport because you must move at least 
two files (the tarball and patch file; the .dsc file is optional) rather than just one. 
Debian source packages also support just one patch file, whereas RPM source 
packages may contain multiple patch files. Although you can certainly combine 
multiple patch files into one, doing so makes it less clear where a patch comes 
from, thus making it harder to back out of any given change. 


These source package differences are mostly of interest to software developers. 
As a system administrator or end user, you need not normally be concerned with 
them unless you must recompile a package from a source form—and even then, 
the differences between the formats need not be overwhelming. The exact 
commands and features used by each system differ, but they accomplish similar 
overall goals. 


Because all distributions that use Debian packages are derived from Debian, they 
tend to be more compatible with one another (in terms of their packages) than 
are RPM-based distributions. In particular, Debian has defined details of its 
system startup scripts and many other features to help Debian packages install 
and run on any Debian-based system. This helps Debian-based systems avoid the 
sorts of incompatibilities in startup scripts that can cause problems using one 
distribution's RPMs on another distribution. Of course, some future distribution 
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guaranteed to hold over time. 


As a practical matter, it can be harder to locate Debian packages than RPM 
packages for some exotic programs. Debian maintains a good collection at 
www.debian.org/distrib/packages, and some program authors make Debian 
packages available as well. If you can find an RPM but not a Debian package, 
you may be able to convert the RPM to Debian format using a program called 
alien, as described shortly in “Converting between Package Formats.” If all else 
fails, you can use a tarball, but you'll lose the advantages of the Debian package 
database. 


Configuring Debian Package Tools 


With the exception of the APT sources list mentioned earlier, Debian package 
tools don't usually require configuration. Debian installs reasonable defaults (as 
do its derivative distributions). On rare occasions, though, you may want to 
adjust some of these defaults. Doing so requires that you know where to look for 
them. 


The main configuration file for dpkg is etcdpkg/dpkg.cfg or ~/.dpkg.cfg. 
This file contains dpkg options, as summarized in Table 2.5, but without the 
leading dashes. For instance, to have dpkg always perform a test run rather than 
actually install a package, you'd create a dpkg.cfg file that contains one line: 


no-act 


For APT, the main configuration file you're likely to modify is 
etcapt/sources. list, which was described earlier in “Using apt-get.” 
Beyond this file is etcapt/apt.conf, which controls APT and dselect options. 
As with dpkg.cfg, chances are you won't need to modify apt . conf. If you do 
need to make changes, the format is more complex and is modeled after those of 
the Internet Software Consortium's (ISC's) Dynamic Host Configuration 
Protocol (DHCP) and Berkeley Internet Name Domain (BIND) servers' 
configuration files. Options are grouped together by open and close curly braces 


({}): 


APT 


{ 
Get 


Download-Only "true"; 


J; 


J; 


These lines are equivalent to setting the - -download-only option permanently, 
as described in Table 2.7. You can, of course, set many more options. For 
details, consult apt .conf's man page. You may also want to review the sample 
configuration file, usrshare/doc/apt/examples/apt .conf. (The working 
etcapt/apt.conf file is typically extremely simple, or it may be missing 
entirely and therefore not be very helpful as an example.) 


You should be aware that Debian's package tools rely on various files in the 
varlib/dpkg directory tree. These files maintain lists of available packages, lists 
of installed packages, and so on. In other words, this directory tree is effectively 
the Debian installed file database. As such, you should be sure to back up this 
directory when you perform system backups and be careful about modifying its 
contents. 


Converting between Package Formats 


Sometimes you're presented with a package file in one format, but you want to 
use another format. This is particularly common when you use a Debian-based 
distribution and can find only tarballs or RPM files of a package. When this 
happens, you can keep looking for a package file in the appropriate format, 
install the tools for the foreign format, create a package from a source tarball 
using the standard RPM or Debian tools, or convert between package formats 
with a utility like alien. 


This section focuses on this last option. The alien program comes with Debian 
and a few other distributions, but it may not be installed by default. If it's not 
installed on your system, install it by typing apt-get install alienona 
system that uses APT, or use the RPMFind or Debian package website to locate 
it. This program can convert between RPM packages, Debian packages, 
Stampede packages (used by Stampede Linux), and tarballs. 


You need to be aware of some caveats. For one thing, alien requires that you 
have appropriate package manager software installed—for instance, both RPM 
and Debian—to convert between these formats. The alien utility doesn't always 
convert all dependency information completely and correctly. When converting 
from a tarball, alien copies the files directly as they had been in the tarball, so 
alien works only if the original tarball has files that should be installed off the 
root (/) directory of the system. 
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Although alien requires both RPM and Debian package systems to be 
installed to convert between these formats, it doesn't use the database 
features of these packages unless you use the - -install option. The 
presence of a foreign package manager isn't a problem as long as you don't 
use it to install software that might duplicate or conflict with software 
installed with your primary package manager. 


The basic syntax of alien is as follows: 
alien [options] file[...] 


The most important options are --to-deb, --to-rpm, --to-slp, and --to-tgz, 
which convert to Debian, RPM, Stampede, and tarball format, respectively. (If 
you omit the destination format, alien assumes that you want a Debian 
package.) The - -install option installs the converted package and removes the 
converted file. Consult the alien man page for additional options. 


For instance, suppose you have a Debian package called someprogram-1.2.3- 
4_i386.deb, and you want to create an RPM from it. You can issue the 
following command to create an RPM called someprogram-1.2.3-4.i1386.rpm: 


# alien --to-rpm someprogram-1.2.3-4 _1386.deb 


If you use a Debian-based system and want to install a tarball but keep a record 
of the files it contains in your Debian package database, you can do so with the 
following command: 


# alien --install binary-tarball.tar.gz 


It's important to remember that converting a tarball converts the files in the 
directory structure of the original tarball using the system's root directory as the 
base. Therefore, you may need to unpack the tarball, juggle files around, and 
repack it to get the desired results prior to installing the tarball with alien. For 
instance, suppose you have a binary tarball that creates a directory called 
program-files, with bin, man, and lib directories under this. The intent may 
have been to unpack the tarball in /usr or usrlocal and create links for critical 


files. To convert this tarball to an RPM, you can issue the following commands: 


tar xvfz program.tar.gz 

mv program-files usr 

tar cvfz program.tgz usr 
rm -r usr 

alien --to-rpm program.tgz 
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By renaming the program- files directory to usr and creating a new tarball, 
you've created a tarball that, when converted to RPM format, will have files in 
the locations you want—usrbin, usrman, and usrlib. You might need to 
perform more extensive modifications, depending on the contents of the original 
tarball. 


Package Dependencies and Conflicts 


Although package installation often proceeds smoothly, sometimes it doesn't. 
The usual sources of problems relate to unsatisfied dependencies or conflicts 
between packages. The RPM and Debian package management systems are 
intended to help you locate and resolve such problems. However, on occasion 
(particularly when mixing packages from different vendors), they can actually 
cause problems. In either event, it pays to recognize these errors and know how 
to resolve them. 
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If you use a meta-packager, such as Yum or APT, for all of your package 
management, you're much less likely to run into problems with package 


dependencies and conflicts. These problems are most likely to arise when 
you install lone packages, especially those from unusual sources. 


Real and Imagined Package Dependency Problems 


Package dependencies and conflicts can arise for a variety of reasons, including 


the following: 
Missing Libraries or Support Programs 


One of the most common dependency problems is caused by a missing 


support package. For instance, all KDE programs rely on Qt, a widget set 
that provides assorted GUI tools. If Qt isn't installed, you won't be able to 


install any KDE packages using RPMs or Debian packages. Libraries— 


support code that can be used by many different programs as if it were part 
of the program itself—are particularly common sources of problems in this 


respect. 


Incompatible Libraries or Support Programs 


Even if a library or support program is installed on your system, it may be 
the wrong version. For instance, if a program requires Qt 4.8, the presence 


of Qt 3.3 won't do much good. Fortunately, Linux library-naming 


conventions enable you to install multiple versions of a library in case you 


have programs with competing requirements. 
Duplicate Files or Features 


Conflicts arise when one package includes files that are already installed 
and that belong to another package. Occasionally, broad features can 
conflict as well, as in two web server packages. Feature conflicts are 


usually accompanied by name conflicts. Conflicts are most common when 
mixing packages intended for different distributions, because distributions 


may split files across packages in different ways. 


Mismatched Names 


RPM and Debian package management systems give names to their 
packages. These names don't always match across distributions. For this 
reason, if one package checks for another package by name, the first 
package may not install on another distribution, even if the appropriate 
package is installed, because that target package has a different name. 


Some of these problems are very real and serious. Missing libraries, for instance, 
must be installed. (Sometimes, though, a missing library isn't quite as missing as 
it seems, as described in the upcoming section “Forcing the Installation.”’) 
Others, like mismatched package names, are artifacts of the packaging system. 
Unfortunately, it's not always easy to tell into which category a conflict fits. 
When using a package management system, you may be able to use the error 
message returned by the package system, along with your own experience with 
and knowledge of specific packages, to make a judgment. For instance, if RPM 
reports that you're missing a slew of libraries with which you're unfamiliar, 
you'll probably have to track down at least one package—unless you know 
you've installed the libraries in some other way, in which case you may want to 
force the installation. 


Workarounds for Package Dependency Problems 


When you encounter an unmet package dependency or conflict, what can you do 
about it? There are several approaches to these problems. Some of these 
approaches work well in some situations but not others, so you should review the 
possibilities carefully. The options include forcing the installation, modifying 
your system to meet the dependency, rebuilding the problem package from 
source code, and finding another version of the problem package. 


Forcing the Installation 


One approach is to ignore the issue. Although this sounds risky, it's appropriate 
in some cases involving failed RPM or Debian dependencies. For instance, if the 
dependency is on a package that you installed by compiling the source code 
yourself, you can safely ignore the dependency. When using rpm, you can tell the 
program to ignore failed dependencies by using the - -nodeps parameter: 


# rpm -i apackage.rpm --nodeps 


You can force installation over some other errors, such as conflicts with existing 
packages, by using the - - force parameter: 


# rpm -i apackage.rpm --force 
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Do not use --nodeps or - -force as a matter of course. Ignoring the 
dependency checks can lead you into trouble, so you should use these 
options only when you need to do so. In the case of conflicts, the error 
messages you get when you first try to install without -- force will tell you 


which packages' files you'll be replacing, so be sure you back them up or that 
you are prepared to reinstall the packages in case of trouble. 


If you're using dpkg, you can use the - - ignore-depends=package, - -force- 
depends, and --force-conflicts parameters to overcome dependency and 
conflict problems in Debian-based systems. Because there's less deviation in 
package names and requirements among Debian-based systems, these options 
are less often needed on such systems. 


Upgrading or Replacing the Depended-on Package 


Officially, the proper way to overcome a package dependency problem is to 
install, upgrade, or replace the depended-on package. If a program requires, say, 
Qt 4.8 or greater, you should upgrade an older version (such as 4.4) to 4.8. To 
perform such an upgrade, you'll need to track down and install the appropriate 
package. This usually isn't too difficult if the new package you want comes from 
a Linux distribution, especially if you use a meta-packager such as Yum or APT; 
the appropriate depended-on package should come with the same distribution. 


One problem with this approach is that packages intended for different 
distributions sometimes have differing requirements. If you run Distribution A 
and install a package that was built for Distribution B, the package will express 
dependencies in terms of Distribution B's files and versions. The appropriate 
versions may not be available in a form intended for Distribution A, and by 
installing Distribution B's versions, you can sometimes cause conflicts with 
other Distribution A packages. Even if you install the upgraded package and it 
works, you may run into problems in the future when it comes time to install 
some other program or upgrade the distribution as a whole—the upgrade 
installer may not recognize Distribution B's package or may not be able to 
upgrade to its own newer version. 


Rebuilding the Problem Package 


Some dependencies result from the libraries and other support utilities installed 
on the computer that compiled the package, not from requirements in the 
underlying source code. If the software is recompiled on a system that has 
different packages, the dependencies will change. Therefore, rebuilding a 
package from source code can overcome at least some dependencies. 


Most developer-oriented RPM-based systems, such as Fedora, include a 
command to rebuild an RPM package: You call rpmbuild (or rpm with old 
versions of RPM) with the name of the source package and use - - rebuild, as 
follows: 


# rpmbuild --rebuild packagename-version.src.rpm 


Of course, to do this you must have the source RPM for the package. This can 
usually be obtained from the same location as the binary RPM. When you 
execute this command, rpmbuild extracts the source code and executes whatever 
commands are required to build a new package—or sometimes several new 
packages. (One source RPM can build multiple binary RPMs.) The compilation 
process can take anywhere from a few seconds to several hours, depending on 
the size of the package and the speed of your computer. The result should be one 
or more new binary RPMs in usrsrc/distname/RPMS/arch, where distname is 
a distribution-specific name (such as redhat on Red Hat or packages on SUSE) 
and arch is your CPU architecture (such as i386 or i586 for x86 or ppc for 
PowerPC). You can move these RPMs to any convenient location and install 
them just as you would any others. 
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Source packages are also available for Debian systems, but aside from sites 
devoted to Debian and related distributions, Debian source packages are 
rare. The sites that do have these packages provide them in forms that 
typically install easily on appropriate Debian or related systems. For this 
reason, it's less likely that you'll rebuild a Debian package from source. 


Be aware that compiling a source package typically requires you to have 
appropriate development tools installed on your system, such as the GNU 
Compiler Collection (GCC) and assorted development libraries. Development 
libraries are the parts of a library that enable programs to be written for the 
library. Many Linux installations lack development libraries even when the 
matching binary libraries are installed. Thus, you may need to install quite a few 
packages to recompile a source package. The error messages you receive when 
you attempt but fail to build a source package can help you track down the 
necessary software, but you may need to read several lines of error messages and 
use your package system to search for appropriate tools and development 
libraries. (Development libraries often include the string dev or devel in their 
names.) 


Locating Another Version of the Problem Package 


Frequently, the simplest way to fix a dependency problem or package conflict is 
to use a different version of the package that you want to install. This could be a 
newer or older official version (4.2.3 rather than 4.4.7, say), or it might be the 
same official version but built for your distribution rather than for another 
distribution. Sites like RPMFind (www. rpmfind .net) and Debian's package 
listing (www. debian .org/distrib/packages) can be very useful in tracking 
down alternative versions of a package. Your own distribution's website or FTP 
site can also be a good place to locate packages. 
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If the package you're trying to install requires newer libraries than you have, 
and you don't want to upgrade those libraries, an older version of the 
package may work with your existing libraries. Before installing such a 
program, though, you should check to be sure that the newer version of the 
program doesn't fix security bugs. If it does, you should find another way to 
install the package. 


The main problem with locating another version of the package is that 
sometimes you really need the version that's not installing correctly. It may have 
features that you need, or it may fix important bugs. On occasion, other versions 
may not be available, or you may be unable to locate another version of the 
package in your preferred package format. 


Startup Script Problems 


One particularly common problem when trying to install servers from one 
distribution in another is getting startup scripts to work. In the past, most major 
Linux distributions used SysV startup scripts, but these scripts weren't always 
transportable across distributions. Today, alternatives to SysV are common, such 
as the systemd startup method, which further complicates this problem. The 
result is that the server you installed may not start up. Possible workarounds 
include modifying the startup script that came with the server, building a new 
script based on another one from your distribution, and starting the server 
through a local startup script like etcrc.d/rc.local or etcrc.d/boot. local. 
Chapter 5, “Booting Linux and Editing Files,” describes startup scripts in more 
detail. 
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Startup script problems affect only servers and other programs that are 
started automatically when the computer boots; they don't affect typical user 
applications or libraries. 


Managing Shared Libraries 


Most Linux software relies heavily on shared libraries. The preceding sections 
have described some of the problems that can arise in managing shared library 
packages—for example, if a library isn't installed or is the wrong version, you 
may have problems installing a package. Library management goes beyond 
merely configuring them, though. To understand this, you must first understand 
a few library principles. You can then move on to setting the library path and 
using commands that manage libraries. 


Library Principles 


The idea behind a library is to simplify programmers' lives by providing 
commonly used program fragments. For instance, one of the most important 
libraries is the C library (libc), which provides many of the higher-level features 
associated with the C programming language. Another common type of library is 
associated with GUIs. These libraries are often called widget sets because they 
provide the onscreen widgets used by programs—buttons, scroll bars, menu bars, 
and so on. The GIMP Tool Kit (GTK+) and Qt are the most popular Linux 
widget sets, and both ship largely as libraries. Programmers choose libraries, not 
users; you usually can't substitute one library for another. (The main exceptions 
are minor version upgrades.) 
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Linux uses the GNU C library (glibc) version of the C library. Package- 
manager dependencies and other library references are to glibc specifically. 
As of glibc 2.15, for historical reasons the main glibc file is usually called 
liblibc.so.6 or 1ib64libc.so.6, but this file is sometimes a symbolic link 
to a file of another name, such as 1iblibc-2.15.so. 


In principle, the routines in a library can be linked into a program's main file, 
just like all of the object code files created by the compiler. This approach, 
however, has certain problems: 


e The resulting program file is huge. This means it takes up a lot of disk 
space, and it consumes a lot of RAM when loaded. 


e If multiple programs use the library, as is common, the program-size issue 
is multiplied several times; the library is effectively stored multiple times 
on disk and in RAM. 


e The program can't take advantage of improvements in the library without 
being recompiled (or at least relinked). 


For these reasons, most programs use their libraries as shared libraries (aka 
dynamic libraries). In this form, the main program executable omits most of the 
library routines. Instead, the executable includes references to shared library 
files, which can then be loaded along with the main program file. This approach 
helps keep program file size down, enables sharing of the memory consumed by 
libraries across programs, and enables programs to take advantage of 
improvements in libraries by upgrading the library. 
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Linux shared libraries are similar to the dynamic link libraries (DLLs) of 
Windows. Windows DLLs are usually identified by .d11 filename 
extensions. In Linux, however, shared libraries usually have a .so or 
.so.version extension, where version is a version number. (.so stands for 
shared object.) Linux static libraries (used by linkers for inclusion in 
programs when dynamic libraries aren't to be used) have .a filename 
extensions. 


On the downside, shared libraries can degrade program load time slightly if the 
library isn't already in use by another program, and they can create software 
management complications: 


e Shared library changes can be incompatible with some or all programs that 
use the library. Linux uses library-numbering schemes to enable you to 
keep multiple versions of a library installed at once. Upgrades that shouldn't 
cause problems can overwrite older versions, whereas major upgrades get 
installed side by side with their older counterparts. This approach 
minimizes the chance of problems, but sometimes changes that shouldn't 
cause problems do cause them. 


e Programs must be able to locate shared libraries. This task requires 
adjusting configuration files and environment variables. If it's done wrong, 
or if a program overrides the defaults and looks in the wrong place, the 
result is usually that the program won't run at all. 


e The number of libraries for Linux has risen dramatically over time. When 
they're used in shared form, the result can be a tangled mess of package 
dependencies, particularly if you use programs that rely on many or obscure 
libraries. In most cases, this issue boils down to a package problem that can 
be handled by your package management tools. 


e If an important shared library becomes inaccessible because it was 
accidentally overwritten due to a disk error or for any other reason, the 
result can be severe system problems. In a worst-case scenario, the system 
might not even boot. 


In most cases, these drawbacks are manageable and are much less important than 
the problems associated with using static libraries. Thus, dynamic libraries are 
very popular. 
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Developers who create programs using particularly odd, outdated, or 
otherwise exotic libraries sometimes use static libraries. This enables them 
to distribute their binary packages without requiring users to obtain and 
install their oddball libraries. Likewise, static libraries are sometimes used 
on small emergency systems, which don't have enough programs installed to 
make the advantages of shared libraries worth pursuing. 


Locating Library Files 


The major administrative challenge of handling shared libraries involves 
enabling programs to locate those shared libraries. Binary program files can 
point to libraries either by name alone (as in libc.so.6) or by providing a 
complete path (as in liblibc.so.6). In the first case, you must configure a 
library path—a set of directories in which programs should search for libraries. 
This can be done both through a global configuration file and through an 
environment variable. If a static path to a library is wrong, you must find a way 
to correct the problem. In all of these cases, after making a change, you may 
need to use a special command to get the system to recognize the change, as 
described later in “Library Management Commands.” 


Setting the Path System Wide 


The first way to set the library path is to edit the etcld.so.conf file. This file 
consists of a series of lines, each of which lists one directory in which shared 
library files may be found. Typically, this file lists between half a dozen and a 
couple dozen directories. Some distributions have an additional type of line in 
this file. These lines begin with the include directive; they list files that are to 
be included as if they were part of the main file. For instance, Ubuntu 12.04's 
1d.so.conf begins with this line: 


include etcld.so.conf.d/*.conf 


This line tells the system to load all of the files in etcld.so.conf.d whose 
names end in .conf as if they were part of the main etcld.so.conf file. This 


mechanism enables package maintainers to add their unique library directories to 
the search list by placing a .conf file in the appropriate directory. 


Some distributions, such as Gentoo, use a mechanism with a similar goal but 
different details. With these distributions, the env-update utility reads files in 
etcenv.d to create the final form of several /etc configuration files, including 
etcld.so.conf. In particular, the LDPATH variables in these files are read, and 
their values make up the lines in 1d.so.conf. Thus, to change 1d.so.conf in 
Gentoo or other distributions that use this mechanism, you should add or edit 
files in etcenv.d and then type env-update to do the job. 


Generally speaking, there's seldom a need to change the library path system 
wide. Library package files usually install themselves in directories that are 
already on the path or add their paths automatically. The main reason to make 
such changes would be if you installed a library package, or a program that 
creates its own libraries, in an unusual location via a mechanism other than your 
distribution's main package utility. For instance, you might compile a library 
from source code and then need to update your library path in this way. 


After you change your library path, you must use ldconfig to have your 
programs use the new path, as described later in “Library Management 
Commands.” 


zx 


In addition to the directories specified in etcld.so.conf, Linux refers to the 
trusted library directories, /1ib and /usr/1ib. These directories are always 
on the library path, even if they aren't listed in 1d.so.conf. 


Temporarily Changing the Path 


Sometimes, changing the path permanently and globally is unnecessary and even 
inappropriate. For instance, you might want to test the effect of a new library 
before using it for all of your programs. To do so, you could install the shared 
libraries in an unusual location and then set the LD_LIBRARY_PATH environment 
variable. This environment variable specifies additional directories the system is 
to search for libraries. 
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Chapter 9, “Writing Scripts, Configuring Email, and Using Databases,” 
describes environment variables in more detail. 


To set the LD_LIBRARY_PATH environment variable using the bash shell, you can 
type a command like this: 


$ export LD_LIBRARY_PATH=usrlocal/test1lib:optnewlib 


This line adds two directories, usrlocal/testlib and optnew1lib, to the search 
path. You can specify as few or as many directories as you like, separated by 
colons. These directories are added to the start of the search path, which means 
they take precedence over other directories. This fact is handy when you're 
testing replacement libraries, but it can cause problems if users manage to set 
this environment variable inappropriately. 


You can set this environment variable permanently in a user's shell startup script 
files, as described in Chapter 9. Doing so means the user will always use the 
specified library paths in addition to the normal system paths. In principle, you 
could set the LD_LIBRARY_PATH globally; however, using etcld.so.conf is the 
preferred method of effecting global changes to the library path. 


Unlike other library path changes, this one doesn't require that you run ldconfig 
for it to take effect. 


Correcting Problems 


Library path problems usually manifest as a program's inability to locate a 
library. If you launch the program from a shell, you'll see an error message like 
this: 


$ gimp 

gimp: error while loading shared libraries: libXinerama.so.1: 
cannot~CA 

open shared object file: No such file or directory 


This message indicates that the system couldn't find the libxXinerama.so.1 
library file. The usual cause of such problems is that the library isn't installed, so 


you should look for it using commands such as find (described in Chapter 4, 
“Managing Files”). If the file isn't installed, try to track down the package to 
which it should belong (a Web search can work wonders for this task) and install 
it. 

If, on the other hand, the library file is available, you may need to add its 
directory globally or to LD_LIBRARY_PATH. Sometimes, the library's path is hard- 
coded in the program's binary file. (You can discover this using 1dd, as 
described shortly in “Library Management Commands.”) When this happens, 
you may need to create a symbolic link from the location of the library on your 
system to the location the program expects. A similar problem can occur when 
the program expects a library to have one name but the library has another name 
on your system. For instance, the program may link to biglib.so.5, but your 
system has biglib.so.5.2 installed. Minor version-number changes like this are 
usually inconsequential, so creating a symbolic link will correct the problem: 


# In -s biglib.so.5.2 biglib.so.5 


You must type this command as root in the directory in which the library 
resides. You must then run ldconfig, as described in the next section. 


Library Management Commands 


Linux provides a pair of commands that you're likely to use for library 
management. The 1dd program displays a program's shared library dependencies 
—that is, the shared libraries that a program uses. The ldconfig program 
updates caches and links used by the system for locating libraries—that is, it 
reads etcld.so.conf and implements any changes in that file or in the 
directories to which it refers. Both of these tools are invaluable in managing 
libraries. 


Displaying Shared Library Dependencies 


If you run into programs that won't launch because of missing libraries, the first 
step is to check which libraries the program file uses. You can do this with the 
ldd command: 


$ ldd binls 
linux-vdso.so.1 => (0x00007fff77bfe000) 
libselinux.so.1=>libx86_64/libselinux.so.1 (0x00007f878f48f000) 
libacl.so.1 => 1ibx86_64-linux-gnu/libacl.so.1 
(0x00007f878f287000) 


libc.so.6 => 1i1bx86_64-linux-gnu/libc.so.6 (0x00007f878eeCc0000 ) 

libpcre.so.3 => 1i1bx86_64-linux-gnu/libpcre.so.3 
(0x00007f878eCc82000) 

libdl.so.2 => 11bx86_64-linux-gnu/libdl.so.2 
(0x00007f878ea7e000) 

1ib641d-linux-x86-64.s0.2 (0x00007f878f6cb000 ) 

libattr.so.1 => 11bx86_64-linux-gnu/libattr.so.1 
(0x00007f878e878000) 
$ 


Each line of output begins with a library name, such as librt.so.1 or 
libncurses.so.5. If the library name doesn't contain a complete path, 1dd 
attempts to find the true library and displays the complete path following the => 
symbol, as in liblibrt.so.1 or liblibncurses.so.5. You needn't be 
concerned about the long hexadecimal number following the complete path to 
the library file. The preceding example shows one library (1ib641d-1inux-x86- 
64.s0.2) that's referred to with a complete path in the executable file. It lacks 
the initial directory-less library name and => symbol. 


The 1dd command accepts a few options. The most notable of these is probably 
-v, which displays a long list of version information following the main entry. 
This information may be helpful in tracking down which version of a library a 
program is using, in case you have multiple versions installed. 


Keep in mind that libraries can themselves depend on other libraries, thus you 
can use ldd to discover what libraries are used by a library. Because of this 
potential for a dependency chain, it's possible that a program will fail to run even 
though all of its libraries are present. When using 1dd to track down problems, 
be sure to check the needs of all the libraries of the program, and all of the 
libraries used by the first tier of libraries, and so on, until you've exhausted the 
chain. 


The ldd utility can be run by ordinary users as well as by root. You must run it 
as root if you can't read the program file as an ordinary user. 


Rebuilding the Library Cache 


Linux (or, more precisely, the 1d.so and 1d-linux. so programs, which manage 
the loading of libraries) doesn't read etcld.so.conf every time a program runs. 
Instead, the system relies on a cached list of directories and the files they contain 
stored in binary format in etcld.so.cache. This list is maintained in a format 
that's much more efficient than a plain-text list of files and directories. The 
drawback is that you must rebuild that cache every time you add or remove 


libraries. These additions and removals include both changing the contents of the 
library directories and adding or removing library directories. 


The tool to do this job is called ldconfig. Ordinarily, it's called without any 
options: 


# ldconfig 


This program does, though, take options to modify its behavior: 
Display Verbose Information 


Ordinarily, ldconfig doesn't display any information as it works. The -v 
option causes the program to summarize the directories and files it's 
registering as it goes about its business. 


Don't Rebuild the Cache 


The -N option causes ldconfig not to perform its primary duty of updating 
the library cache. It will, though, update symbolic links to libraries, which 
is a secondary duty of this program. 


Process Only Specified Directories 


The -n option causes ldconfig to update the links contained in the 
directories specified on the command line. The system won't examine the 
directories specified in etcld.so.conf or the trusted directories (/lib and 
usrlib). 


Don't Update Links 


The -x option is the opposite of -N; it causes ldconfig to update the cache 
but not manage links. 


Use a New Configuration File 


You can change the configuration file from etcld.so.conf by using the -f 
conffile option, where conf file is the file you want to use. 


Use a New Cache File 


You can change the cache file that ldconfig creates by passing the -c 
cachefile option, where cachefile is the file you want to use. 


Use a New Root 


The -r dir option tells ldconfig to treat dir as if it were the root (/) 
directory. This option is helpful when you're recovering a badly corrupted 


system or installing a new OS. 
Display Current Information 


The -p option causes ldconfig to display the current cache—all of the 
library directories and the libraries they contain. 


Both RPM and Debian library packages typically run ldconfig 
automatically after installing or removing the package. The same thing 
happens as part of the installation process for many packages compiled 
from source. Thus, you may well be running ldconfig more than you 
realize in the process of software management. You may need to run the 
program yourself if you manually modify your library configuration in any 
way. 


Managing Processes 


When you type a command name, that program is run and a process is created 
for it. Knowing how to manage these processes is critical to using Linux. Key 
details in this task include identifying processes, manipulating foreground and 
background processes, killing processes, and adjusting process priorities. 


Understanding the Kernel: The First Process 


The Linux kernel is at the heart of every Linux system. Although you can't 
manage the kernel process in quite the way you can manage other processes, 
short of rebooting the computer, you can learn about it. To do so, you can use 
the uname command, which takes several options to display information: 


Node Name 


The -n or - -nodename option displays the system's node name; that is, its 
network hostname. 


Kernel Name 


The -s or --kernel-name option displays the kernel name, which is Linux 
on a Linux system. 


Kernel Version 


You can find the kernel version with the -v or - -kernel-version option. 
Ordinarily, this holds the kernel build date and time, not an actual version 
number. 


Kernel Release 


The actual kernel version number can be found via the -r or - -kernel- 
release option. 


Machine 


The -m or - -machine option returns information about your machine. This 
is likely to be a CPU code, such as i686 or x86_64. 


Processor 


Using the -p or --processor option may return information about your 
CPU, such as the manufacturer, model, and clock speed; in practice, it 
returns unknown on many systems. 


Hardware Platform 


Hardware platform information is theoretically returned by the -i or - - 
hardware-platform option, but this option often returns unknown. 


OS Name 


The -o or --operating-system option returns the OS name—normally 
GNU/Linux for a Linux system. 


Print All Information 
The -a or - -a11 option returns all available information. 


In practice, you're most likely to use uname -a at the command line to learn 
some of the basics about your kernel and system. The other options are most 
useful in multiplatform scripts, which can use these options to obtain critical 
information quickly in order to help them adjust their actions for the system on 
which they're running. 


Examining Process Lists 


One of the most important tools in process management is ps. This program 
displays processes’ status (hence the name, ps). It sports many helpful options, 
and it's useful in monitoring what's happening on a system. This can be 
particularly critical when the computer isn't working as it should be—for 
instance, if it's unusually slow. The ps program supports an unusual number of 
options, but just a few of them will take you a long way. Likewise, interpreting 
ps output can be tricky because so many options modify the program's output. 
Some ps-like programs, most notably top, also deserve attention. 


Using Useful ps Options 
The official syntax for ps is fairly simple: 
ps [options] 


This simplicity of form hides considerable complexity because ps supports three 
different types of options as well as many options within each type. The three 
types of options are as follows: 


Unix98 Options 


These single-character options may be grouped together and are preceded 
by a single dash (-). 


BSD Options 


These single-character options may be grouped together and must not be 
preceded by a dash. 


GNU Long Options 


These multi-character options are never grouped together. They're preceded 
by two dashes (- -). 


Options that may be grouped together may be clustered without spaces between 
them. For instance, rather than typing ps -a -f, youcantype ps -af. The 
reason for so much complexity is that the ps utility has historically varied a lot 
from one Unix OS to another. The version of ps that ships with major Linux 
distributions attempts to implement most features from all these different ps 
versions, so it supports many different personalities. In fact, you can change 
some of its default behaviors by setting the PS_PERSONALITY environment 
variable to posix, old, linux, bsd, sun, digital, or various others. The rest of 
this section describes the default ps behavior on most Linux systems. 


Some of the more useful ps features include the following: 
Display Help 
The --help option summarizes some of the more common ps options. 
Display All Processes 


By default, ps displays only processes that were run from its own terminal 
(xterm, text-mode login, or remote login). The -A and -e options cause it to 
display all of the processes on the system, and x displays all processes 
owned by the user who gives the command. The x option also increases the 
amount of information that's displayed about each process. 


Display One User's Processes 


You can display processes owned by a given user with the -u user, U user, 
and - -User options. The user variable may be a username or a user ID. 


Display Extra Information 


The -f, -1, j, 1, u, and v options all expand the information provided in the 
ps output. Most ps output formats include one line per process, but ps can 
display enough information that it's impossible to fit it all on one 80- 
character line. Therefore, these options provide various mixes of 
information. 


Display Process Hierarchy 


The -H, -f, and --forest options group processes and use indentation to 
show the hierarchy of relationships between processes. These options are 
useful if you're trying to trace the parentage of a process. 


Display Wide Output 


The ps command output can be more than 80 columns wide. Normally, ps 
truncates its output so that it will fit on your screen or xterm. The -w and w 
options tell ps not to do this, which can be useful if you direct the output to 
a file, as in ps w > ps.txt. You can then examine the output file in a text 
editor that supports wide lines. 


You can combine these ps options in many ways to produce the output you 
want. You'll probably need to experiment to learn which options produce the 
desired results because each option modifies the output in some way. Even those 
that would seem to influence just the selection of processes to list sometimes 
modify the information that's provided about each process. 


Interpreting ps Output 


Listing 2.3 and Listing 2.4 show a couple of examples of ps in action. Listing 
2.3 shows ps -u rodsmith --forest, and Listing 2.4 shows ps u rodsmith. 


Listing 2.3: Output of ps -u rodsmith --forest 


$ ps -u rodsmith --forest 


PID 
2451 
2551 
2496 
2498 
2505 


TTY 
pts/3 
pts/3 
? 
pts/1 
pts/1 


2506 % 
2544 7 
19221 7 


00 
00 
00 
00 
00 
00 
00 


TIME 


:00:00 
:00:00 
:00:00 
:00:00 
:00:00 
:00:00 
:00:00 
00: 


00:01 


CMD 

bash 

ps 

kvt 

bash 

\_ nedit 

\_ csh 
\_ xeyes 

dfm 


Listing 2.4: Output of ps u rodsmith 


$ ps u rodsmith 
PID %CPU %MEM 


USER 


VSZ RSS TTY 





STAT START 


COMMAND 

rodsmith 19221 0.0 1.5 4484 1984 ? S May07 0:01 
dfm 

rodsmith 2451 0.0 0.8 1856 1048 pts/3 S 16:13 0:00 - 
bash 

rodsmith 2496 0.2 3.2 6232 4124 ? S 16:17 0:00 
optkd 

rodsmith 2498 0.0 0.8 1860 1044 pts/1 S 16:17 0:00 
bash 

rodsmith 2505 0.1 2.6 4784 3332 pts/1 S 16:17 0:00 
nedit 


rodsmith 2506 0.0 0.7 2124 1012 ? S 16:17 0:00 
bincs 
rodsmith 2544 0.0 1.0 2576 1360 ? S 16:17 0:00 
xeyes 


rodsmith 2556 0.0 0.7 2588 916 pts/3 R 16:18 0:00 ps 
u 





The output produced by ps normally begins with a heading line, which displays 
the meaning of each column. Important information that may be displayed (and 
labeled) includes the following: 


Username 


This is the name of the user who runs the programs. Listing 2.3 and Listing 
2.4 restricted this output to one user to limit the length of the listings. 


Process ID 


The process ID (PID) is a number that's associated with the process. This 
item is particularly important because you need it to modify or kill the 
process, as described later in this chapter. 


Parent Process ID 


The parent process ID (PPID) identifies the process's parent. (Neither 
Listing 2.3 nor Listing 2.4 shows the PPID.) 


TTY 


The teletype (TTY) is a code used to identify a terminal. As illustrated by 
Listing 2.3 and Listing 2.4, not all processes have TTY numbers—X 
programs and daemons, for instance, don't. Text-mode programs do have 
these numbers, which point to a console, xterm, or remote login session. 


CPU Time 


The TIME and %CPU headings are two measures of CPU time used. The first 
indicates the total amount of CPU time consumed, and the second 
represents the percentage of CPU time the process is using when ps 
executes. Both can help you spot runaway processes—those that are 
consuming too much CPU time. Unfortunately, what constitutes “too 
much” varies from one program to another, so it's impossible to give a 
simple rule to help you spot a runaway process. 


CPU Priority 


As described shortly, in “Managing Process Priorities,” it's possible to give 
different processes different priorities for CPU time. The NI column, if 
present (it's not in the preceding examples) lists these priority codes. The 
default value is 0. Positive values represent reduced priority, whereas 
negative values represent increased priority. 


Memory Use 


Various headings indicate memory use—for instance, RSS is resident set 
size (the memory used by the program and its data), and %MEM is the 
percentage of memory the program is using. Some output formats also 
include a SHARE column, which is memory that's shared with other 
processes (such as shared libraries). As with CPU-use measures, these 
columns can help point you to the sources of difficulties, but because 
legitimate memory needs of programs vary so much, it's impossible to give 
a simple criterion for when a problem exists. 


Command 


The final column in most listings is the command used to launch the 
process. This is truncated in Listing 2.4 because this format lists the 
complete command, but so much other information appears that the 
complete command won't usually fit on one line. (This is where the wide- 
column options can come in handy.) 


As you can see, a lot of information can be gleaned from a ps listing—or 
perhaps that should be the plural listings, because no single format includes all 
of the available information. For the most part, the PID, username, and 
command are the most important pieces of information. In some cases, though, 
you may need other specific components. If your system's memory or CPU use 
has skyrocketed, for instance, you'll want to pay attention to the memory or CPU 
use column. 


A 


It's often necessary to find specific processes. You might want to find the 
PID associated with a particular command in order to kill it, for instance. 
This information can be gleaned by piping the ps output through grep, as in 
ps ax | grep bash to find all of the instances of bash. 


Although you may need a wide screen or xterm to view the output, you may find 
ps -A --forest to be a helpful command in learning about your system. 
Processes that aren't linked to others were either started directly by init or have 
had their parents killed, and so they have been “adopted” by init. (Chapter 5 
describes init and the boot procedure in more detail.) Most of these processes 
are fairly important—they're servers, login tools, and so on. Processes that hang 
off several others in this tree view, such as xeyes and nedit in Listing 2.3, are 
mostly user programs launched from shells. 


top: A Dynamic ps Variant 


If you want to know how much CPU time various processes are consuming 
relative to one another, or if you want to discover quickly which processes are 
consuming the most CPU time, a tool called top is the one for the job. The top 
tool is a text-mode program, but of course it can be run in an xterm or similar 
window, as shown in Figure 2.2. There are also GUI variants, like kpm and 
gnome-system-monitor. By default, top sorts its entries by CPU use, and it 
updates its display every few seconds. This makes it a very good tool for 
spotting runaway processes on an otherwise lightly loaded system—those 
processes almost always appear in the first position or two, and they consume an 
inordinate amount of CPU time. Figure 2.2 shows a typical top output screen, 
displaying the different processes and their CPU utilization. You'll need to be 
familiar with the purposes and normal habits of programs running on your 
system in order to make such determinations; the legitimate needs of different 
programs vary so much that it's impossible to give a simple rule for judging 
when a process is consuming too much CPU time. 


(x) rich@rich-VirtualBox: ~ 


top - 00:33:31 up 20 min, 2 users, load average: 0.47, 0.45, 0.35 

Tasks: 165 total, 2 running, 163 sleeping, © stopped, © zombie 

“Cpu(s): 19.5 us, 2.7 sy, 0.0 ni, 77.9 id, 0:0 wa, 0:0 hi, 0:0-si, 6.6 st 
KiB Mem: 1773568 total, 1428692 used, 344876 free, 41996 buffers 

KiB Swap: 1813500 total, © used, 1813500 free. 612756 cached Mem 


S %CPU %MEM COMMAND 
compiz 

xorg 

top 

init 
kthreadd 
ksoftirqd/9 
kworker/0:0 
kworker/0:0H 
kworker/u2:0 
rcu_sched 
rcuos/0 
rcu_bh 
rcuob/® 
migration/® 
watchdog/0 
khelper 
kdevtmpfs 


1319016 229808 39860 
296656 71928 15492 
29136 1644 1156 
EE VAs): ) 3068 1464 

0 0 0 


v 
~ 
> @ 
ow 
= 
> w 


I 
O 
6 
6 
6 
8 
6 
O 
-20 
0 
0 
o 
0 
o 
9 
0 
-20 
0 


eoeooocoocooooeo7dcso 
Qoeoqooqocoodooqodc ® 

OR OR OR OR OR OR © BoB oR oR oi «) 
yvyuuNuuNuNYNauuNuYNuNuuNnuYNunuYuanuY 
eooooocooocoqoqocoqoco 
eoococoocoocoeocoeco w 
eoooocoocoocoeocld lwo 
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Figure 2.2 The top command shows system summary information and 
information about the most CPU-intensive processes on a computer. 


Like many Linux commands, top accepts several options. The most useful are 
listed here: 


-d delay 

This option specifies the delay between updates, which is normally 5 
seconds. 

-p pid 

If you want to monitor specific processes, you can list them using this 
option. You'll need the PIDs, which you can obtain with ps, as described 


earlier. You can specify up to 20 PIDs by using this option multiple times, 
once for each PID. 


-n iter 


You can tell top to display a certain number of updates (iter) and then 
quit. (Normally, top continues updating until you terminate the program.) 


-b 


This option specifies batch mode, in which top doesn't use the normal 
screen-update commands. You might use this to log CPU use of targeted 
programs to a file, for instance. 


You can do more with top than watch it update its display. When it's running, 
you can enter any of several single-letter commands, some of which prompt you 
for additional information. These commands include the following: 


h and ? 


These keystrokes display help information. 

k 

You can kill a process with this command. The top program will ask for a 
PID number, and if it's able to kill the process, it will do so. (The upcoming 
section “Killing Processes” describes other ways to kill processes.) 

q 

This option quits from top. 

2 

You can change a process's priority with this command. You'll have to enter 
the PID number and a new priority value—a positive value will decrease its 
priority, and a negative value will increase its priority, assuming it has the 
default 0 priority to begin with. Only root may increase a process's priority. 


The renice command (described shortly, in “Managing Process Priorities”) 
is another way to accomplish this task. 


S 


This command changes the display's update rate, which you'll be asked to 
enter (in seconds). 


P 


This command sets the display to sort by CPU usage, which is the default. 
M 


You can change the display to sort by memory usage with this command. 


PO 
gr 
If you're just looking for the memory usage on the system, try using the free 


command. It provides a quick glance at how much physical and swap 
memory is in use, and how much is available. 


More commands are available in top (both command-line options and 
interactive commands) than can be summarized here; consult top's man page for 
more information. 


One of the pieces of information provided by top is the load average, which is a 
measure of the demand for CPU time by applications. In Figure 2.2, you can see 
three load-average estimates on the top line; these correspond to the current load 
average and two previous measures. A system on which no programs are 
demanding CPU time has a load average of 0.0. A system with one program 
running CPU-intensive tasks has a load average of 1.0. Higher load averages 
reflect programs competing for available CPU time. You can also find the 
current load average via the uptime command, which displays the load average 
along with information on how long the computer has been running. The load 
average can be useful in detecting runaway processes. For instance, if a system 
normally has a load average of 0.5 but suddenly gets stuck at a load average of 
2.5, a couple of CPU-hogging processes may have hung—that is, become 
unresponsive. Hung processes sometimes needlessly consume a lot of CPU time. 
You can use top to locate these processes and, if necessary, kill them. 


PO 
gr 
Most computers today include multiple CPUs or CPU cores. On such 
systems, the load average can equal the number of CPUs or cores before 
competition for CPU time begins. For instance, on a quad-core CPU, the 
load average can be as high as 4.0 without causing contention. Typically, 
one program can create a load of just 1.0; however, multithreaded programs 
can create higher load averages, particularly on multi-core systems. 


jobs: Processes Associated with Your Session 


The jobs command displays minimal information about the processes associated 
with the current session. In practice, jobs is usually of limited value, but it does 
have a few uses. One of these is to provide job ID numbers. These numbers are 
conceptually similar to PID numbers, but they're not the same. Jobs are 
numbered starting from 1 for each session and, in most cases, a single shell has 
only a few associated jobs. The job ID numbers are used by a handful of utilities 
in place of PIDs, so you may need this information. 


A second use of jobs is to ensure that all of your programs have terminated prior 
to logging out. Under some circumstances, logging out of a remote login session 
can cause the client program to freeze up if you've left programs running. A 
quick check with jobs will inform you of any forgotten processes and enable 
you to shut them down. 


pgrep: Finding Processes 


The pgrep command was introduced in the Solaris operating system, but it has 
been ported to the open-source world and is becoming more popular in Linux. It 
allows you to perform simple searches within the process list; similar to piping 
the ps command output to the grep command. 


The format of the pgrep command is as follows: 


pgrep [-flvx] [-n | -o] [-d delim] [-P ppidlist] [-g 
pgrplist ] 

[-s sidlist] [-u euidlist] [-U uidlist] [-G gidlist] 

[-J projidlist] [- t termlist] [-T taskidlist] [-c ctidlist] 


[-z zoneidlist] [pattern] 


You can search for processes based on the username, user ID, or group ID as 
well as any type of regular expression pattern: 


$ pgrep -u root cron 
812 
$ 


This example searches for a process named cron, run by the root user account. 
Notice that the pgrep command only returns the process ID value of the 
processes that match the query. 


Understanding Foreground and Background Processes 


One of the most basic process-management tasks is to control whether a process 
is running in the foreground or the background; that is, whether it's 
monopolizing the use of the terminal from which it was launched. Normally, 
when you launch a program, it takes over the terminal, preventing you from 
doing other work in that terminal. (Some programs, though, release the terminal. 
This is most common for servers and some GUI programs.) 


If a program is running but you decide you want to use that terminal for 
something else, pressing Ctrl+Z normally pauses the program and gives you 
control of the terminal. (An important point is that this procedure suspends the 
program, so if it's performing real work, that work stops!) This can be handy if, 
say, you're running a text editor in a text-mode login and you want to check a 
filename so that you can mention it in the file you're editing. You press Ctrl+Z 
and type 1s to get the file listing. To get back to the text editor, you then type fg, 
which restores the text editor to the foreground of your terminal. If you've 
suspended several processes, you add a job number, as in fg 2, to restore job 2. 
You can obtain a list of jobs associated with a terminal by typing jobs, which 
displays the jobs and their job numbers. 


A variant on fg is bg. Whereas fg restores a job to the foreground, bg restores a 
job to running status, but in the background. You can use this command if the 
process you're running is performing a CPU-intensive task that requires no 
human interaction but you want to use the terminal in the meantime. Another use 
of bg is in a GUI environment—after launching a GUI program from an xterm 
or similar window, that shell is tied up servicing the GUI program, which 
probably doesn't really need the shell. Pressing Ctrl+Z in the xterm window will 
enable you to type shell commands again, but the GUI program will be frozen. 


To unfreeze the GUI program, type bg in the shell, which enables the GUI 
program to run in the background while the shell continues to process your 
commands. 


As an alternative to launching a program, using Ctrl+Z, and typing bg to runa 
program in the background, you can append an ampersand (&) to the command 
when launching the program. For instance, rather than editing a file with the 
NEdit GUI editor by typing nedit myfile.txt, you can type nedit 
myfile.txt &. This command launches the nedit program in the background 
from the start, leaving you able to control your xterm window for other tasks. 


Managing Process Priorities 


Sometimes, you may want to prioritize your programs’ CPU use. For instance, 
you may be running a program that's very CPU intensive but that will take a long 
time to finish its work, and you don't want that program to interfere with others 
that are of a more interactive nature. Alternatively, on a heavily loaded 
computer, you may have a job that's more important than others that are running, 
so you may want to give it a priority boost. In either case, the usual method of 
accomplishing this goal is through the nice and renice commands. You can use 
nice to launch a program with a specified priority or use renice to alter the 
priority of a running program. 


You can assign a priority to nice in any of three ways: by specifying the priority 
preceded by a dash (this works well for positive priorities but makes them look 
like negative priorities), by specifying the priority after the -n parameter, or by 
specifying the priority after the --adjustment= parameter. In all cases, these 
parameters are followed by the name of the program you want to run: 


nice [argument] [command [command-arguments] | 


For instance, the following three commands are all equivalent: 


$ nice -12 number-crunch data.txt 
$ nice -n 12 number-crunch data.txt 
$ nice --adjustment=12 number-crunch data.txt 


All three of these commands run the number -crunch program at priority 12 and 
pass it the data. txt file. If you omit the adjustment value, nice uses 10 asa 
default. The range of possible values is —20 to 19, with negative values having 
the highest priority. Only root may launch a program with increased priority 
(that is, give a negative priority value), but any user may use nice to launch a 


program with low priority. The default priority for a program run without nice is 
0. 


If you've found that a running process is consuming too much CPU time or it is 
being swamped by other programs and so should be given more CPU time, you 
can use the renice program to alter its priority without disrupting the program's 
operation. The syntax for renice is as follows: 


renice priority [[-p] pids] [[-9] pgrps] [[-u] users] 


You must specify priority, which takes the same values this variable takes with 
nice. In addition, you must specify one or more PIDs (pids), one or more group 
IDs (pgrps), or one or more usernames (users). In the latter two cases, renice 
changes the priority of all programs that match the specified criterion—but only 
root may use renice in this way. Also, only root may increase a process's 
priority. If you give a numeric value without a -p, -g, or -u option, renice 
assumes the value is a PID. You may mix and match these methods of 
specification. For instance, you might enter the following command: 


# renice 7 16580 -u pdavison tbaker 


This command sets the priority to 7 for PID 16580 and for all processes owned 
by pdavison and tbaker. 


Killing Processes 


Sometimes, reducing a process's priority isn't a strong enough action. A program 
may have become totally unresponsive, or you may want to terminate a process 
that shouldn't be running. In these cases, the kill command is the tool to use. 
This program sends a signal (a method that Linux uses to communicate with 
processes) to a process. The signal is usually sent by the kernel, the user, or the 
program itself to terminate the process. Linux supports many numbered signals, 
each of which is associated with a specific name. You can see them all by typing 
kill -1. If you don't use -1, the syntax for kill is as follows: 


kill -s signal pid 


pm 


Although Linux includes a kill program, many shells, including bash and 
csh, include built-in kill equivalents that work in much the same way as the 
external program. If you want to be sure you're using the external program, 
type its complete path, as in binkill. 


The -s signal parameter sends the specified signal to the process. You can 
specify the signal using either a number (such as 9) or a name (such as SIGKILL). 
The signals you're most likely to use are 1 (SIGHUP, which terminates interactive 
programs and causes many daemons to reread their configuration files), 9 
(SIGKILL, which causes the process to exit without performing routine shutdown 
tasks), and 15 (SIGTERM, which causes the process to exit but allows it to close 
open files and so on). If you don't specify a signal, the default is 15 (SIGTERM). 
You can also use the shortened form -signal1. If you do this and use a signal 
name, you should omit the SIG portion of the name—for instance, use KILL 
rather than SIGKILL. The pid option is, of course, the PID for the process that 
you want to kill. You can obtain this number from ps or top. 


x 


The kill program will kill only those processes owned by the user who runs 
kill. The exception is if that user is root; the superuser may kill any user's 
processes. 


TTX 
f a A. ‘ 


4, ys, 

HH Real World Scenario 
4. 

RTA 


4 


Running Programs Persistently 


The kernel can pass signals to programs, even if you don't use the kill 
command. For instance, when you log out of a session, the programs you 
started from that session are sent the SIGHUP signal, which causes them to 
terminate. If you want to run a program that will continue running even 
when you log out, you can launch it with the nohup program: 


$ nohup program options 


This command causes the program to ignore the SIGHUP signal. It can be 
handy if you want to launch certain small servers that may legitimately be 
run as ordinary users. 





A variant on kill is killall, which has the following form: 
killall [options] [--] name [...] 


This command kills a process based on its name rather than its PID number. For 
instance, killall vi kills all of the running processes called vi. You may 
specify a signal in the shortened form (-signa1) or by preceding the signal 
number with -s or --signal. As with kill, the default is 15 (SIGTERM). One 
potentially important option to killall is -i, which causes it to ask for 
confirmation before sending the signal to each process. You might use it like 
this: 


$ killall -i vi 
Kill vi(13211) ? (y/n) y 
Kill vi(13217) ? (y/n) n 


In this example, two instances of the vi editor were running, but only one should 
have been killed. As a general rule, if you run killall as root, you should use 
the -i parameter; if you don't, it's all too likely that you'll kill processes that you 
shouldn't, particularly if many people are using the computer at once. 


pm 


Some versions of Unix provide a killall command that works very 
differently from Linux's killal11. This alternate killa11 kills all of the 
processes started by the user who runs the command. This is a potentially 
much more destructive command, so if you ever find yourself on a non- 
Linux system, do not use killall until you've discovered what that system's 
killall does (say, by reading the killall man page). 


Another variant on kill is the pkill command, which has the following format: 
pkill [-signal] [-fvx] [-n]-o] [-P ppidlist] [-g pgrplist] [-s 

sidlist] [-u euidlist] [-U uidlist] [-G gidlist] [-J projidlist] [- 
t termlist] [-T taskidlist] [-c ctidlist] [-z zoneidlist] [pattern] 


The pkill command allows you to kill one or more processes based on 
usernames, user IDs, group IDs, and other features as well as using a matching 
regular expression. The pkill command was introduced in the Solaris operating 
system, but it has been ported to the Linux environment and is gaining in 
popularity. 


ghi 
ING 
While the pkill command is extremely versatile, with that versatility comes 
danger. Be extremely careful if you're using regular expressions to match 


process names—it's very easy to match the wrong process names 
inadvertently! 


Summary 


Linux provides numerous tools to help you manage software. Most distributions 
are built around the RPM or Debian package systems, both of which enable 
installation, upgrade, and removal of software using a centralized package 
database to avoid conflicts and other problems that are common when no central 
package database exists. You can perform basic operations on individual files or, 
with the help of extra tools such as Yum and APT, keep your system 
synchronized with the outside world, automatically or semiautomatically 
updating all of your software to the latest versions. 


No matter how you install your software, you may need to manage shared 
libraries. These software components are necessary building blocks of large 
modern programs, and, in the best of all possible worlds, they operate entirely 
transparently. Sometimes, though, shared libraries need to be upgraded or the 
system configuration changed so that programs can find the libraries. When this 
happens, knowing about critical configuration files and commands can help you 
work around any difficulties. 


Beyond managing packages and libraries, Linux software management involves 
manipulating processes. Knowing how to manipulate foreground and 
background processes, adjust process priorities, and kill stray processes can help 
you keep your Linux system working well. 


Exam Essentials 


Identify critical features of RPM and Debian package formats. 


RPM and Debian packages store all of the files for a given package ina 
single file that also includes information about what other packages the 
software depends on. These systems maintain a database of installed 
packages and their associated files and dependencies. 


Describe the tools used for managing RPMs. 


The rpm program is the main tool for installing, upgrading, and uninstalling 


RPMs. This program accepts operations and options that tell it precisely 
what to do. The Yum utility, and particularly its yum command, enables 


installation of a package and all its dependencies via the Internet rather than 


from local package files. 
Describe the tools used for managing Debian packages. 


The dpkg program installs or uninstalls a single package or a group of 
packages that you specify. The apt - get utility retrieves programs from 
installation media or from the Internet for installation, and it can 


automatically upgrade your entire system. The dselect program serves as a 
menu-driven interface to apt-get, enabling you to select programs that you 


want to install from a text-mode menu. 


Summarize tools for extracting files and converting between package 
formats. 


The rpm2cpio program can convert an RPM file to a cpio archive, enabling 
users of non-RPM systems to access files in an RPM. The alien utility can 


convert in any direction between Debian packages, RPMs, Stampede 
packages, and tarballs. This enables the use of packages intended for one 
system on another. 


Summarize the reasons for using shared libraries. 


Shared libraries keep disk space and memory requirements manageable by 


placing code that's needed by many programs in separate files from the 
programs that use it, enabling one copy to be used multiple times. More 


generally, libraries enable programmers to use basic “building blocks” that 


others have written without having to reinvent code constantly. 


Describe methods available to change the library path. 


The library path can be changed system wide by editing the etcld.so.conf 
file and then typing ldconfig. For temporary or per-user changes, 
directories may be added to the path by placing them in the 
LD_LIBRARY_PATH environment variable. 


Explain the difference between foreground and background processes. 


Foreground processes have control of the current terminal or text-mode 
window (such as an xterm). Background processes don't have exclusive 
control of a terminal or text-mode window but are still running. 


Describe how to limit the CPU time used by a process. 


You can launch a program with nice or use renice to alter its priority in 
obtaining CPU time. If a process is truly out of control, you can terminate it 
with the kill command. 


Review Questions 


1. Which of the following is not an advantage of a source package over a binary 
package? 


A. A single source package can be used on multiple CPU architectures. 


B. 


C. 


D. 
E. 


By recompiling a source package, you can sometimes work around library 
incompatibilities. 


You can modify the code in a source package, thus altering the behavior of 
a program. 


Source packages can be installed more quickly than binary packages. 


You may be able to recompile source code for a non-Linux Unix program 
on Linux. 


2. Which is true of using both RPM and Debian package management systems 
on one computer? 


A. 


B. 


C. 
D. 
E. 


It's generally inadvisable because the two systems don't share installed-file 
database information. 


It's impossible because their installed-file databases conflict with one 
another. 


It causes no problems if you install important libraries once in each format. 
It's a common practice on Red Hat and Debian systems. 


Using both systems simultaneously requires installing the alien program. 


3. Which of the following statements is true about binary RPM packages that are 
built for a particular distribution? 


A 


. License requirements forbid using the package on any other distribution. 
B. 


They may be used in another RPM-based distribution only when you set the 
--convert-distrib parameter to rpm. 


. They may be used in another RPM-based distribution only after you 


recompile the package's source RPM. 


. They can be recompiled for an RPM-based distribution running on another 


type of CPU. 


E. They can often be used on another RPM-based distribution for the same 
CPU architecture, but this isn't guaranteed. 


4. An administrator types the following command on an RPM-based Linux 
distribution: 


# rpm -ivh megaprog.rpm 


What is the effect of this command? 
A. If the megaprog package is installed on the computer, it is uninstalled. 


B. If the megaprog.rpm package exists, is valid, and isn't already installed on 
the computer, it is installed. 


C. The megaprog.rpm source RPM package is compiled into a binary RPM for 
the computer. 


D. Nothing; megaprog.rpm isn't a valid RPM filename, so rpm will refuse to 
operate on this file. 


E. The megaprog. rpm package replaces any earlier version of the package 
that's already installed on the computer. 


5. Which of the following commands will extract the contents of the 
myfonts.rpm file into the current directory? 


A. rpm2cpio myfonts.rpm | cpio -i --make-directories 
B. rpm2cpio myfonts.rpm > make-directories 

C. rpm -e myfonts.rpm 

D. alien --to-extract myfonts.rpm 

E. rpmbuild --rebuild myfonts.rpm 


6. To use dpkg to remove a package called theprogram, including its 
configuration files, which of the following commands would you issue? 


A. dpkg -e theprogram 
B. dpkg -p theprogram 
C. dpkg -r theprogram 
D. dpkg -r theprogram-1.2.3-4.deb 
E. dpkg -P theprogram 


7. Which of the following describes a difference between apt-get and dpkg? 


A. 


B. 
C. 


E. 


apt-get provides a GUI interface to Debian package management; dpkg 
doesn't. 


apt-get can install tarballs in addition to Debian packages; dpkg can't. 


apt-get can automatically retrieve and update programs from Internet sites; 
dpkg can't. 


. apt-get is provided only with the original Debian distribution, but dpkg 


comes with Debian and its derivatives. 


apt-get works only with Debian-based distributions, but dpkg can work 
with both RPMs and Debian packages. 


8. What command would you type to obtain a list of all of the installed packages 
on a Debian system? 


A. 
B. 
C. 
D. 
E. 


apt-get showall 
apt-cache showpkg 
dpkg -r allpkgs 
dpkg -i 


dpkg --get-selections 


9. As root, you type apt-get update on a Debian system. What should be the 
effect of this command? 


A 


E. 


. None: update is an invalid option to apt-get. 
B. 


The APT utilities deliver information about the latest updates you've made 
to the APT Internet repositories, enabling you to share your changes with 
others. 


. The APT utilities download all available upgrades for your installed 


programs and install them on your system. 


. The APT utilities retrieve information about the latest packages available so 


that you may install them with subsequent apt -get commands. 


The APT utilities update themselves, ensuring that you're using the latest 
version of APT. 


10. Which of the following commands would you type to update the unzip 
program on a Fedora system to the latest version? (Select all that apply.) 


A. yum update unzip 

B. yum upgrade unzip 

C. yum -u unzip 

D. yum -U unzip 

E. yum check-update unzip 


11. How should you configure a system that uses Yum to access an additional 
Yum software repository? 


A. Edit the etcapt/sources.1list file to include the repository site's URL, as 
detailed on the repository's website. 


B. Download a package from the repository site, and install it with RPM, or 
place a configuration file from the repository site in the etcyum.repos.d 
directory. 


C. Use the add-repository subcommand to yum or the Add Repository option 
in the File menu in yumex, passing it the URL of the repository. 


D. Edit the etcyum.conf file, locate the [repos] section, and add the URL to 
the repository after the existing repository URLs. 


E. Edit the etcyum.conf file, locate the REPOSITORIES= line, and add the new 
repository to the colon-delimited list on that line. 


12. What is the preferred method of adding a directory to the library path for all 
users? 


A. Modify the LD_LIBRARY_PATH environment variable in a global shell script. 
B. Add the directory to the etcld.so.conf file, and then type ldconfig. 
C. Type ldconfig newdir, where newdir is the directory you want to add. 


D. Create a symbolic link from that directory to one that's already on the 
library path. 


E. Type ldd newdir, where newdir is the directory you want to add. 


13. You prefer the look of GTK+ widgets to Qt widgets, so you want to 
substitute the GTK+ libraries for the Qt libraries on your system. How would 
you do this? 


A. You must type ldconfig --makesubs=qt, gtk. This command substitutes 
the GTK+ libraries for the Qt libraries at load time. 


B. You must uninstall the Qt library packages and reinstall the GTK+ packages 
with the --substitute=qt option to rpm or the --replace=qt option to 
dpkg. 


C. You must note the filenames of the Qt libraries, uninstall the packages, and 
create symbolic links from the Qt libraries to the GTK+ libraries. 


D. You can't easily do this; libraries can't be arbitrarily exchanged for one 
another. You would need to rewrite all of the Qt-using programs to use 
GTK+. 


E. You must reboot the computer and pass the subst=qt, gtk option to the 
kernel. This causes the kernel to make the appropriate substitutions. 


14. A user types kill -9 11287 at a bash prompt. What is the probable intent, 
assuming the user typed the correct command? 


A. To cut off a network connection using TCP port 11287 


B. To display the number of processes that have been killed with signal 11287 
in the last nine days 


C. To cause a server with process ID 11287 to reload its configuration file 
D. To terminate a misbehaving or hung program with process ID 11287 
E. To increase the priority of the program running with process ID 11287 


15. What programs might you use to learn what your system's load average is? 
(Select two.) 


A. ld 

B. load 
C. top 

D. uptime 
E. la 


16. Which of the following commands creates a display of processes, showing 
the parent-child relationships through links between their names? 


A. ps --forest 
B. ps aux 


C. ps -e 


D. ps --tree 
E. All of the above 


17. You use top to examine the CPU time being consumed by various processes 
on your system. You discover that one process, dfcomp, is consuming more 
than 90 percent of your system's CPU time. What can you conclude? 
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script.sh file has no execute permissions set on it. 


The following list describes the various script execution methods: 
bash script -name 


Typing the script's name, preceded by bash, tells Linux to run the script in 


the current directory rather than searching the current path: 


$ bash my-script.sh 
PID PPID CMD 
2821 2820 -bash 
2867 2821 \_ bash my-script.sh 
2868 2867 \_ ps -o pid -o ppid -o cmd --forest 
Done with Script 
$ 


This method does not require execution permission to run the script. 
However, it does create a subshell to run the script as indicated by the bash 
my-script.sh line in the output's third line. 


./script -name 


Typing the script's name, preceded by ./, tells Linux to run the script in the 
current directory rather than searching the current path: 


$ ./my-script.sh 
-bash: ./my-script.sh: Permission denied 
$ 
$ chmod u+x my-script.sh 
$ 
$ ./my-script.sh 
PID PPID CMD 
2821 2820 -bash 
2883 2821 \_ binbash ./my-script.sh 
2884 2883 \_ ps -o pid -o ppid -o cmd --forest 
Done with Script 
$ 


This method does require execution permission. As you can see in the 
preceding example, the chmod u+x command is needed in order to use this 
execution method. It also creates a subshell to run the script as indicated 
by the tobash ./my-script.sh example line. 


/directory-location/script -name 


Just typing in the script's full path and name is needed when the script is not 
located in your current working directory: 


$ chmod u-x my-script.sh 

$ 

$ mv my-script.sh homeChristine/NewDir/ 
$ 

$ homeChristine/NewDir/my-script.sh 


-bash: homeChristine/NewDir/my-script.sh: Permission denied 
$ 
$ chmod u+x homeChristine/NewDir/my-script.sh 
$ 
$ homeChristine/NewDir/my-script.sh 
PID PPID CMD 
2821 2820 -bash 
2905 2821 \_ binbash homeChristine/NewDir/my-script.sh 
2906 2905 \_ ps -o pid -o ppid -o cmd --forest 
Done with Script 
$ 


This method also requires the execution permission to be set on the script. 
It creates a subshell to run the script as well. 


script -name 


Just typing in the script's name requires the shell script to be moved to a 
directory on your path, such as usrlocal/bin. This is the preferred method 
for scripts that will be used by others: 


$ cd homeChristine/NewDir 
$ 
$ sudo mv my-script.sh usrlocalbin 
[sudo] password for Christine: 
$ 
$ chmod a+x usrlocalbinmy-script.sh 
$ 
$ echo $PATH 
usr1ib64/qt-3.3/bin:usrlocal/bin:/bin:usrbin: 
usrlocal/sbin:usrsbin:/sbin:homeChristine/bin 
$ 
$ my-script.sh 
PID PPID CMD 
2821 2820 -bash 
2928 2821 \_ binbash usrlocalbinmy-script.sh 
2929 2928 \_ ps -o pid -o ppid -o cmd --forest 
Done with Script 
$ 


This method requires the appropriate execution permission to be set. Since 
it will be used by all system users, the chmod a+x command is used to 
grant execute permission to everyone. Note that the $PATH environment 
variable contains the directory usrlocal/bin, where the my-script.sh 
file was moved. Also note that this method creates a subshell when the 
script is run. 


sh script -name 


Typing the script's name, preceded by sh, is nearly identical to preceding it 
with the bash command. It tells Linux to run the script in the current 
directory rather than searching the current path: 


$ sudo mv usrlocalbinmy-script.sh homeChristine/ 
[sudo] password for Christine: 
$ 
$ cd homeChristine 
$ 
$ chmod a-x my-script.sh 
$ 
$ sh my-script.sh 
PID PPID CMD 
2821 2820 -bash 
2973 2821 \_ sh my-script.sh 
2974 2973 \_ ps -o pid -o ppid -o cmd --forest 
Done with Script 
$ 


This method does not require execution permission to run the script, and it 
creates a subshell to run the script as indicated by the sh my-script.sh 
line in the output. 


source script -name 


Typing the keyword source before the script name tells the bash shell to 
use a method type called sourcing. When you source a script, a subshell is 
not created to run the script. 


$ source my-script.sh 
PID PPID CMD 
2821 2820 -bash 
3095 2821 \_ ps -o pid -o ppid -o cmd --forest 
Done with Script 
$ 


Notice that no new process (subshell) was created to run the my-script.sh 
script. It ran in the current bash shell (PID 2821). This method also does 
not require execute permission. 


. Script -name 
Typing a dot (.) and then a space before the script name also tells the bash 


shell to use the sourcing method type. Be careful; don't forget to include the 
space between the dot and the script name: 


$ . my-script.sh 
PID PPID CMD 
2821 2820 -bash 
3157 2821 \_ ps -o pid -o ppid -o cmd --forest 
Done with Script 
$ 


This method also does not create a subshell. The script ran in the current 
bash shell (PID 2821). In addition, this method does not need execute 
permission set on the file. 


exec ./script-name 


The last method for executing script uses the exec command. This method 
does need execute permission set on the file. Be aware, if you are following 
along with the book and executing scripts, you will need to add a pause to 
the bottom of your script. Here the sleep 10 command was added to the 
my-script.sh script so the script will pause for 10 seconds before 
completing. This is needed because the exec command will exit the current 
bash shell when it is done running the script: 


$ cat my-script.sh 


#!binbash 

[... ] 

sleep 10 

echo Done with Script 

# 

$ 

$ chmod a+x my-script.sh 
$ 


$ exec ./my-script.sh 

PID PPID CMD 
2821 2820 binbash homeChristine/my-script.sh 
3197 2821 \_ ps -o pid -o ppid -o cmd --forest 


Notice that the ./ execution method had to be placed before the script's 
name. This is because exec is not truly a script execution method. It does 
not create a subshell but instead replaces the current shell with an 
executable image environment to run the script. A script execution method 
must be included in the exec command line in order to run a script. You 
cannot source a script using exec, however. Only execution methods that 
create a subshell will work with the exec command: 


$ exec source my-script.sh 
-bash: exec: source: not found 


$ 
$ exec . my-script.sh 
-bash: exec: .: not found 
$ 
$ exec bash my-script.sh 
PID PPID CMD 
3257 3256 bash my-script.sh 
3301 3257 \_ ps -o pid -o ppid -o cmd --forest 
$ 


The exec program's primary value is not in running scripts. Instead, it is 
often used to run a program from within a script. 


There are only two methods listed previously that are considered sourcing 
methods: the source command and the dot (.). Using a sourcing method that 
causes a script to run in the current shell, as opposed to launching a new instance 
of the shell (subshell), has some important implications: 


e When you source a script, it will have access to environment variables set 
in the calling shell. This is true even if you haven't exported them. Without 
sourcing, only environment variables that you explicitly export become 
available to scripts you run. 


e If you source a script and if that script sets an environment variable, that 
variable will become available (or will be changed) in the calling shell's 
environment. If you run the script without using a sourcing method, any 
environment variables it sets will remain local to it and to the programs that 
it calls. This is true even if the script exports the variables. 


e Running a script without sourcing imposes overhead costs associated with 
launching the new shell instance (subshell). These costs are normally 
negligible, but if a script calls itself recursively or calls many other scripts, 
sourcing those scripts within the first script may improve performance. 


e Sourcing a script causes it to execute in the calling shell's language, 
whereas running a script normally causes it to use the shell language 
specified on the shebang line. 


Many administrative tasks conducted via shell scripts require you to process data 
and provide a means for temporary storage. For this reason, scripting languages 
include additional features to help you make your scripts useful. 


Using Variables in Shell Scripts 


Variables can help you expand the utility of scripts. A variable is a placeholder 
in a script for a value that will be determined when the script runs. Variables' 
values can be passed as parameters to scripts, generated internally to the scripts, 
or extracted from the script's environment. 


Understanding Positional Parameter Variables 


Variables that are passed to the script are frequently called positional 
parameters. The individual parameters are represented by a dollar sign ($) 
followed by a number from 0 to 9—$0 stands for the name of the script, $1 is the 
first parameter to the script, $2 is the second parameter, and so on. 


To show parameter variables in action, a simple script for creating user accounts 
has been written (see Chapter 7, “Administering the System,” for more 
information on creating user accounts). Keep in mind that this script will not 
work for all distributions because it uses the useradd command, whereas some 
distributions use the adduser command. If you want to use it on your Linux 
system, some modifications may be required: 


$ cat mkuser.sh 

#!binbash 

# 

# Create user accounts & their passwords 
HEHEHE AHHEEHHHHEA AREER 
# 

# Create user account ### 

echo Account for $1 is being created... 


# 

useradd $1 

# 

# Set user account password ### 

# 

echo Password for $1 is being set... 
# 

passwd $1 

# 

echo Account is ready for use. 

# 
HEHEHE AAA 
$ 


Notice in the mkuser. sh script that the positional parameter, $1, is used in both 
the useradd and the passwd commands as well as in a couple of echo 
commands. Also notice that in the previous example, the script's first line, the 


shebang, shows that binbash acts as the script's program interpreter. After that 
first line, you see both hash marks (#) denoting comments or actual bash shell 
commands. 


Z 


Notice that some of the mkuser . sh script's hash marks are on lines by 
themselves. This provides spacing in the script, which adds to its readability. 
Shell scripts should be easy to read. This helps when script modifications are 
needed. 


The mkuser . sh script creates an account and changes the account's password 
based upon the account name being passed as positional parameter $1. Because 
the script needs superuser privileges to accomplish its task, the sudo command is 
used when executing the script, as shown here: 


$ chmod u+x mkuser.sh 

$ 

$ sudo ./mkuser.sh River 

Account for River is being created... 
Password for River is being set... 
Changing password for user River. 

New password: 

Retype new password: 

passwd: all authentication tokens updated successfully. 
Account is ready for use. 

$ 

$ tail -1 etcpasswd 

River:x:506:510: :/home/River :/bin/bash 
$ 


Notice that the position parameter variable passed to the mkuser . sh script has 
the value of River. Therefore, in every spot where the $1 variable was in the 
script, River is now used instead. This script, though very simple, can be used 
effectively, for instance for creating multiple user accounts at one time. 


With a little modification to the mkuser.sh script, you can grab more positional 
parameters from the command line and create more than one account at a time! 
Here's a snipped example: 


$ cat mkuser.sh 
#!/bin/bash 
# 


[L] 
# 


passwd $1 

# 

echo Account is ready for use. 

# 

# Create user account ### 

echo Account for $2 is being created.. 


# 

useradd $2 

# 

# Set user account password ### 

# 

echo Password for $2 is being set... 
# 

passwd $2 

# 

echo Account is ready for use. 

# 
HHHRHHHHHHHHHHHHHRHHHHHHHHHHHHHHHHHHHHHH 
$ 


The script now has additional code to handle creating a second user account 
using the name passed as the second positional parameter, $2. Here is the 
modified script in action: 


$ sudo ./mkuser.sh Malcolm Inara 

[sudo] password for Christine: 

Account for Malcolm is being created.. 
Password for Malcolm is being set... 
Changing password for user Malcolm. 

New password: 

Retype new password: 

passwd: all authentication tokens updated successfully. 
Account is ready for use. 

Account for Inara is being created... 
Password for Inara is being set... 

Changing password for user Inara. 

New password: 

Retype new password: 

passwd: all authentication tokens updated successfully. 
Account is ready for use. 

$ 

$ tail -2 etcpasswd 

Malcolm: x:507:507: :/home/Malcolm: /bin/bash 
Inara: x:508:511: :/home/Inara:/bin/bash 

$ 


Two parameters are now passed to the script, Malcolm and Inara. The 
mkuser.sh script handles them both via positional parameters. The script uses $1 
as a variable to handle the Malcolm parameter and $2 as a variable to handle the 
Inara parameter. 


You may want to be able to send any number of user accounts to be created to 
the mkuser.sh script. However, you'll need either test constructs or a loop to 
handle this requirement. These topics are covered shortly in this chapter. 


Understanding User-Defined Variables 


A user-defined variable is a variable defined by a user for various purposes, such 
as temporarily storing data. It can be used within a script or at the command line. 
The following example demonstrates defining a user-defined variable, called 
My_Var, at the command line: 


$ My_Var="Hello World" 
$ 

$ echo $My_Var 

Hello World 

$ 


Once the variable has been set, various programs or other commands can use it, 
such as the echo command. Notice that when setting the My_Var variable's value, 
there is no dollar sign ($) in the variable's name. However, when used with the 
echo command, the dollar sign must be included. 
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It is difficult to remember when to use and when not to use the dollar sign 
($) with an environment or user-defined variable. Just remember that if you 
are doing anything with the variable, use the dollar sign. If you are doing 
anything to the variable, such as assigning a value to it, don't use the dollar 
sign. 


You can remove both environment and user-defined variables. The unset 
command accomplishes this task, as shown in the example here: 


$ echo $My_Var 
Hello world 


$ 
$ unset My_Var 
$ 
$ echo $My_Var 
$ 


Notice that in the preceding example, once the variable was unset, the echo 
$My_Var command just displays a blank line. This indicates that the variable has 
been removed. Using the unset command can be very useful in scripts as well as 
the command line. 


Variables are often assigned within scripts. They may hold data pertinent for a 
script's execution. Script variables can also be set from a command's output, 
which is useful! You can then use these variables' values in conjunction with 
normal commands as if they were command parameters. 


ghi 
ING 
Be careful when creating new variable names. It is best to use either all 
lowercase names or mixed-case names. Remember that most environment 
variable names are all uppercase letters. If you use all uppercase variable 


names in your scripts, you may accidently reset an environment variable! 
This could have serious consequences. 


To demonstrate setting variables in a script, the mkuser.sh shell script shown 
earlier has been modified. The first modification was to remove the account 
creation commands for the $2 positional parameter, since they are not needed 
here. A few additional echo commands were added to make the displayed output 
easier to read. Another modification was to create a user-defined variable, 
Username, and set it to the $1 parameter's value. Here is the mkuser . sh after it 
was modified: 


$ cat mkuser.sh 
#!/bin/bash 


# Create user accounts & their passwords 


HEHEHE HHHHHAHEHHAEE HAE 


# Set variables ### 


Username=$1 
# 


# Create user account ### 


echo 


echo Account for $Username is being created... 


echo 


# 
useradd $Username 

# 
# Set user account password ### 

# 


echo Password for $Username is being set... 


echo 


passwd $Username 


# Display account record ### 


User_Record=$(grep $Username etcpasswd) 
# 


echo 


echo Here is $Username\'s record\: 


echo $User_Record 


echo 


echo Account is ready for use. 


HHHHHHHHHHHHHHHHHHHRHHRHHHHHHHHHHHHHHHHH 


$ 


There is another modification that you may have noticed in the mkuser . sh script. 
This modification is rather interesting. A variable, User_Record, was set to the 
results of a grep command. You can capture a command's results by placing the 
command between two parentheses and preceding it with a dollar sign. Thus 
when the grep $Username etcpassword command executes, instead of its 
output going to the display (STDOUT), it is redirected to the User_Record 
variable! This method of storing a command's results in a variable is sometimes 
called “command substitution.” 


z= 


There is an older method for storing a command's results in a variable using 
back-tick (~) characters. Back-tick characters are not single quotes ('). The 
back-tick key is typically shared with the tilde (~) character on your 
keyboard. To use them for storing a command's results, you replace the 
parentheses with back-ticks and remove the dollar sign. Therefore, the line 
in the mkdir .sh script would look like this instead: 


User_Record= grep $Username etcpasswd~ 


Using back-ticks has fallen out of favor. They are hard to see and often 
confused with single quotes. It's preferable to use the $(command) for storing 
command results in a variable. 


To show you how these variables perform within the modified mkuser . sh script, 
the script is run here: 


$ sudo ./mkuser.sh Jayne 

Account for Jayne is being created... 
Password for Jayne is being set... 
Changing password for user Jayne. 

New password: 

Retype new password: passwd: all authentication tokens updated 
successfully. 

Here is Jayne's record: 

Jayne: x:509:512: :/home/Jayne:/bin/bash 
Account is ready for use. 

$ 


That works great! The script successfully used two methods of defining 
variables. 


In addition to assigning variables with the assignment operator (=), you can read 
variables from standard input using the read command, as in read 
response_variabl]e, to read input. The script user's response is stored in the 
response_variable for later access as $response_variable. This method of 
variable assignment is useful for scripts that must interact with users. For 
instance, instead of reading the username from the command line, the mkuser .sh 


script may be modified to prompt the user for the username. 
Here are the first few lines of the modified mkuser . sh script: 


$ cat mkuser.sh 

#!/bin/bash 

## Create user accounts & their passwords 
H#HAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH 
# 

# Obtain variable value ### 

# 

echo 

echo -e "Please enter username for account: \c" 
read Username 

# 

# Create user account ### 


[.] 


Instead of using Username=$1, the script employs the use of an echo statement to 
ask the user for the username. The read command accepts the user's input and 
stores it in the variable Username. The rest of the script is unchanged. 


zx 


Notice that the echo command uses a few special options. The -e option 
enables the interpretation of backslash escapes. In other words, it allows the 
use of the \c option at the output's end. The \c option will stop output from 
echo. These two options allow the script user to type a response on the same 
line as the question. 


Here is the modified mkuser . sh script in action. The only difference is that the 
script asks for the username instead of having to pass the username as a 
parameter. Therefore, the output has been snipped: 


$ sudo ./mkuser.sh 

[sudo] password for Christine: 

Please enter username for account: Kaylee 
Account for Kaylee is being created... 


[...] 

Here is Kaylee's record: 

Kaylee: x:510:513: :/home/Kaylee: /bin/bash 
Account is ready for use. 

$ 


This mkuser .sh script version works equally as well as the others. By using the 
various user-defined variable options, you can create scripts to meet any 
requirements. 


Using Environment Variables in Scripts 


One special type of variable, the environment variable, was mentioned in the 
section “Managing the Shell Environment,” earlier in this chapter. Environment 
variables are assigned and accessed just like other shell script variables. The 
difference is that the script or command that sets an environment variable uses 
the export command (in bash). This makes the variable's value accessible to 
subshells. For example, suppose you set an environment variable in Script_A 
and Script_A Starts Script_B in a manner that creates a subshell. Script_B can 
use the environment variable too! 


Environment variables are often set in shell startup scripts, but the scripts you 


use can access them. For instance, your script may call a program that checks for 
the $DISPLAY environment variable and abort if it finds that this variable isn't set. 
Remember, most environment variable names are all uppercase, whereas non- 
environment shell script variables should all be lowercase or mixed case. 


Using variables in shell scripts is handy. However, if a script user forgets to 
enter data for the variable, there can be serious consequences. Thankfully, shell- 
scripting languages support several constructs that help to avoid these problems, 
as covered in the upcoming chapter sections. 


Using Conditional Expressions 


Scripting languages support several types of conditional expressions. These 
expressions enable a script to perform one of several actions contingent upon 
some condition—typically the value of a variable. 


One common command that uses conditional expressions is the if-then 
statement. The simplest form of this statement tests only the success or failure of 
a command, and its syntax is as follows: 


if command 
then 

commands 
fi 


Notice that the syntax keywords consist of if to designate the command 
(command) to issue, then to appoint what happens if the command is successful, 
and fi to designate the end of the statement. To test this statement out, the 
testit.sh script was created: 


$ cat testit.sh 
#!/bin/bash 
# 
# Testing if statements 
HHHHHHHHHHHHHHHHHHHHAHHE 
# 
if date 
then 
echo "It worked" 
fi 
# 
$ 


In the testit.sh script, the date command is issued. If it works correctly, the 


code in the then section is run. Here is this script in action: 


$ chmod u+x testit.sh 

$ 

$ ./testit.sh 

Sat Oct 25 16:36:43 EDT 2015 
It worked 

$ 


You can also add an else section to your if -then statement. This will allow 
commands to be executed, if the command is not successful. The testit.sh 
script has been modified to include an else section as well as an incorrect date 
command: 


$ cat testit.sh 
#!/bin/bash 
# 
# Testing if statements 
HHHHHHHHHHHHHHHHHHHHAHHEA 
# 
if dte 
then 

echo "It worked" 
else 

echo "It did not work" 
fi 
# 
$ 
$ 
$ ./testit.sh 
./testit.sh: line 6: dte: command not found 
It did not work 
$ 


When this version of testit.sh ran, the else section was triggered because 
there is no dte command. If there were a dte command, the then section of the 
if-then-else statement would have been triggered. 


This very basic if-then-else statement syntax has limited use. Where it really 
becomes valuable is when you can test a variable's value. Before looking at 
testing a variable in an if-then-else statement, you need to learn about the 
test command. The syntax for this command is fairly simple: 


test condition 


If the condition (condition) listed in the test command evaluates to true, the 


test command exits with a zero status code. If the condition evaluates to false, 
the test command exits with a nonzero status code. Here is the testit.sh script 
again, this time modified to try out the test command: 


$ cat testit.sh 
#!/bin/bash 

# 

# Testing if statements 
#HHHHHHHHHHHHHHHHHHHHHHH 


# 
# Set variable's value 
# 
My_Variable="Hello World" 
# 
# Test variable's value 
# 
if test "$My_ Variable" 
then 

echo $My_Variable 
else 

echo "Nothing to show" 
fi 
# 


$ ./testit.sh 
Hello World 
$ 


In the preceding script example, the test command determines if the variable 
My_Variable has any content. Since it does, when the script is executed, the 
echo command in the then section is executed. 


Now if the My_Variab1e is set to null in the script, as you would expect, the test 
command results trigger the else section: 


$ cat testit.sh 
#!/bin/bash 

# 

# Testing if statements 
HPHARHRHARHRHRAHHRHRHHRHH 
# 

# Set variable's value 

# 

My_Variable="" 


[..] 
$ 


$ ./testit.sh 


Nothing to show 
$ 


There is an alternative way to define the test condition without using the test 
command. The syntax in an if-then-else statement is as follows: 


if [ condition ] 
then 

commands 
else 

other commands 
fi 


The condition represented by [ condition ] is more commonly known as the 
test condition, and it replaces the test command in comparison syntax. Both the 
test condition and the test command can evaluate three condition types: 


e Numeric comparisons 
e String comparisons and tests 
e File comparisons and tests 


Each comparison uses its own comparison syntax. For example, to test if two 
numbers are equal, the number comparison uses the -eq comparison syntax. To 
test if two strings are equivalent, the string comparison uses the = comparison 
syntax. 


ghi 
ING 
For variables that will be used to store integers, you should use the declare 
command as follows: declare -i variable. If you do not include a 


declaration in your shell script, when you do integer test comparisons, the 
results may not be what you intended! 


You can also test a variable's contents without a comparison. For example, to 
test if a string has a length of zero, use the -z syntax. To test if a file exits, use 
the -f syntax. To see a complete listing of the various available comparisons, 
tests, and their syntaxes, type man test at the command line. 


By modifying the mkuser . sh script, you can test the user's input. The useradd 
command would throw an error if used without giving it a username. To avoid 
this error, the variable Username is tested to ensure that it is not zero length. The 
if statement uses a test condition -z, which tests for a variable of zero length. 
This ensures that the variable Username contains a value before attempting the 
useradd command. 


Here is a segment of the modified script: 


$ cat mkuser.sh 
#!/bin/bash 


# 
[... ] 
# Test variable for content ### 
# 
if [ -z $Username ] 
then 
echo 
echo You did not provide a username 
echo Leaving script... 
exit 
fi 
# 
# Create user account ### 
[... ] 
$ 


Now the modified script can be tested. Instead of a username being entered at 


tha nramnt anly tha Fntar law ic nraccad: 


uilt piviliptl, villy ULC Lutter ncy 15o pitooru. 


$ sudo ./mkuser.sh 

[sudo] password for Christine: 
Please enter username for account: 
You did not provide a username 
Leaving script... 

$ 


In the script's execution, a username was not entered and this meant that the 
Username variable was zero length. Thus, the if -then test condition triggered 
the then section's commands, and the script was exited. Zero-length variables 
can cause many problems in your scripts! It is a good idea to check for them 
always. 


ghi 
ING 
The test condition syntax [ condition ] must have a space after the first 


bracket ([) and before the closing bracket (]). If you leave out the space, 
your if statements will generate an error. 


Test conditions may be combined with the logical “and” (&&) or logical “or” (| |) 
operators. When conditionals are combined with &&, both sides of the operator 
must be true for the condition as a whole to be true. When | | is used, if either 
side of the operator is true, the condition as a whole is true. You will see an 
example of using these combined test conditions in the next section, “Using 
Loops.” 


If a variable can have two or more values, you can use nested if statements to 
test for these conditions. The general syntax is as follows: 


if [ condition1 ] 
then 

commands 
elif [ condition2 | 
then 

more commands 
fi 


Notice that instead of an else keyword, the elif keyword is used. This syntax is 
useful should you need to check for a couple of values. However, this can get 
awkward very quickly if you need to check for more than just a couple of values. 
A cleaner approach is to use the case statement: 


case word in 
pattern1) 
command(s) 


vr 
pattern2) 
command(s) 


vr 
pattern3) 
command(s) 


v7 


esac 


For a case statement, word is likely to be a variable and each instance of 
pattern is a possible value of that variable. The patterns can be expanded much 
like filenames, using the same wildcards and expansion rules (* to stand for any 
string, for instance). You can match an arbitrary number of patterns in this way. 
Each set of commands must end with a double semicolon (; ; ), and the case 
statement as a whole ends in the string esac (case backward). 


a 
grr 
The case statement can be made more compact if needed. For example, the 


pattern, commands, and ending double semicolon can all be on the same 
line, as follows: 


pattern1) command(s) ; ; 


This reduces the script's readability. However, this compacted syntax is there 
if you need it. 


The mkuser.sh can be modified to include a simple case statement. Here are the 
mkuser .sh script's modified sections: 


$ cat mkuser.sh 

#!/bin/bash 

[... ] 

echo -e "Please enter username for account or type Exit: \c" 
read Username 

# 

# Test variable for content ### 

# 

if [ -z $Username ] 


[L] 
# 


case $Username in 
Exit) 
echo Leaving script.. 
exit 
ir 
*) 
echo 
echo Account for $Username is being created... 
ir 
esac 


# 
# Create user account ### 


[L] 
$ 


In this modification, the user can enter either a username to be created or Exit to 


leave the script. The case statement checks for Exit, and if it's found, the 
commands in the Exit section are executed. Anything else entered is assumed to 
be a username, and the script continues. 


Upon execution, bash executes the commands associated with the first pattern to 
match the variable's contents. Execution then jumps to the line following the 
esac Statement; any intervening commands don't execute. If no patterns match 
the word, no code within the case statement executes. 


To see how this works, the modified mkuser . sh script is run. The script user 
enters Exit instead of a username: 


$ sudo ./mkuser.sh 

[sudo] password for Christine: 

Please enter username for account or type Exit: Exit 
Leaving script... 

$ 


This works as expected. A case statement is very handy for handling multiple 
variable values—for example, if all of your system's usernames needed to have 
mixed case and numbers at their end. In the mkuser.sh script, you could test for 
proper usernames and then run the results through a case statement, letting the 
script user know what username problems (if any) exist. 


Using Loops 


Conditional expressions are sometimes used in loops. Loops are structures that 
tell the script to perform the same task repeatedly until some condition is met (or 
until some condition is no longer met). The performed task is typically a 
command or series of commands. 


There are three primary loop types that you can use in a shell script. Two of the 
loop types are based on a test condition, while the other loop type executes its 
task(s) for a certain number of list items. The loop types and their conditions are 
as follows: 


e while condition tests true 
e until condition tests true 
e for items in list 


Each loop type is useful for various purposes. When designing a script that 
requires a loop, you need to spend time thinking through which loop type will 
serve your requirements best. 


Looking at while loops 


The while loop's commands execute while its test condition returns a true. The 
basic form of this loop type goes like this: 


while [ condition ] 
do 

commands 
done 


To show an example of the while loop, the mkuser .sh script has been modified. 
The loop allows for the removal of several previously needed tests. Here is a 
snipped listing of the modified script: 


$ cat mkuser.sh 
#!/bin/bash 
# 
# Create user accounts & their passwords 
HEHEHE AA 
# 
# Obtain variable value ### 
# 
echo 
echo -e "Please enter username for account or type Exit: \c" 
read Username 
# 
while [ $Username != "Exit" ] 
do 
# Create user account ### 
# 
useradd $Username 
# 
# Set user account password ### 
[... ] 
# 
echo Account is ready for use. 
done 
# 
echo Leaving script... 
exit 
# 
HEHEHE AAA 
$ 


The commands within the while loop, listed between the do and done construct, 
will execute as long as the Username variable is not set to Exit. This will allow 


multiple users to be added while running the script. First the exit feature is 
tested: 


$ sudo ./mkuser.sh 

[sudo] password for Christine: 

Please enter username for account or type Exit: Exit 
Leaving script... 

$ 


The script's exit feature works perfectly. Once the Username variable was set to 
Exit, the while loop returned a false. This test condition result caused none of 
the commands between do and done to run. Remember that the while loop's 
commands will execute only if its test condition returns a true. 


Now the modified script is tested for when no username is entered: 


$ sudo ./mkuser.sh 

[sudo] password for Christine: 

Please enter username for account or type Exit: 
./mkuser.sh: line 12: [: !=: unary operator expected 
Leaving script... 

$ 


There's a problem! This test condition threw an error: unary operator 
expected. This is due to the Username variable now being set to nothing (null). 
When the shell interprets this test condition, instead of seeing the ”” != "Exit” 
condition, it sees the != ”Exit” test condition. It appears to the shell that the 
variable is missing. 


There is an easy fix for this problem. Just encase the variable name in double 
quotation marks as follows: 


while [ "$Username" != "Exit" ] 


Now the shell will see ”” != “Exit” if the variable Username is set to null. This 
fix will keep the test condition from generating an error. 
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There is another solution to the problem, if you know this script will run in 
the bash shell. You can use double brackets to enclose a test condition [ [ 
condition ]] that might test an empty variable. 


One issue still exists—your script should exit if it encounters a Username 
variable set to null. This can be handled a couple of different ways. One way is 
use an if-then statement as discussed earlier in the chapter. However, since 
while loops are now being discussed, here is a solution using a modified while 
loop test condition: 


while [ "$Username" != "Exit" ] && [ "$Username" != "" ] 


Using a compound test condition allows the shell to test both for the Username 
variable not being equal to Exit and for the Username variable not being equal to 
null. If both test conditions are true, then the commands in the while loop's do 
and done sections will execute. 


Looking at until loops 


An until loop takes a slightly different approach. An until loop's commands 
execute until its test condition returns a true. The basic form of this loop type is 
as follows: 

until [ condition |] 

do 


commands 
done 


It looks almost identical to the while loop. It takes only a few modifications to a 
single script line to make the mkuser.sh script use an until loop instead of a 
while loop. The while loop test condition currently looks like this: 


while [ "$Username" != "Exit" ] && [ "$Username" != "" ] 
To change this to an until loop, the script line is modified to appear as follows: 


until [ "$Username" = "Exit" ] || [ "$Username" = "" ] 


Now the statement says to execute the commands in the do and done construct 
until the variable Username equals Exit or the variable Username equals null. 


As you can see, there are fairly subtle differences between a while loop and an 
until loop. However, those differences can significantly impact your script if 
test conditions are not written correctly. 


A handy tool to use with until or while loops is the shift command. Positional 
parameters in shell scripts were covered earlier in the chapter. One of the great 
ways to use these parameters is by incorporating the use of the shift command. 


With the shift command, you do not need to know the total number of 
positional parameters passed to the script. The shift command removes the 
value of the $1 parameter, moves the $2 parameter's value into $1, moves the $3 
parameter's value into $2, and so on. 


When shift has passed the last parameter, the $1 variable becomes null. Using a 
loop to test for $1 being set to null and incorporating the shift command into 
the loop's do/done construct allows for clean handling of passed parameters. 


The mkuser.sh script has been modified to use shift within its until loop. 
Here is the snipped script with the changes highlighted: 


$ cat mkuser.sh 

#!/bin/bash 

# 

# Create user accounts & their passwords 
HHEHAHHHHHHHAAHHEEEHHHEAAAAEEEE AAA 


# 
# Obtain variable value ### 
# 
Username=$1 
# 
until [ "$Username" = "" ] 
do 
[... ] 
# Grab next Username 
# 
shift 
Username=$1 
# 
done 
# 
echo Leaving script... 
exit 


# 


HEHEHE 
$ 


The Username variable is initially set to the positional $1 parameter's value 
before the until loop. The until loop's test condition checks to see if 
Username's variable value is null. If the test returns a false, the commands 
between do and done are run. Close to the end of the do/done commands is the 
shift command. The shift command removes the value of the $1 parameter 
and shifts the positional parameters’ values as described earlier. Notice that the 
Username variable must be set again to $1's value, after the shift command, 
because the $1 variable's value has changed. The loop will continue until a null 
value is shifted into the $1 parameter. 


To help you understand a little better how this works, the modified mkuser .sh 
script is shown in action here. Notice that four parameters are passed to the 
script: 


$ sudo ./mkuser.sh Wash Zoe Simon Shepherd 
[sudo] password for Christine: 

[..] Here is Wash's record: 

Wash:x:511:514: :/home/Wash: /bin/bash 

Lawl 

Here is Zoe's record: 
Zoe:X:512:515::/home/Zoe: /bin/bash 

[... ] 

Here is Simon's record: 

Simon: xX:513:516: :/home/Simon: /bin/bash 

[... ] 

Here is Shepherd's record: 

Shepherd: x:514:517::/home/Shepherd: /bin/bash 
Account is ready for use. 

Leaving script... 

$ 


That works great! Now you can simply pass the usernames who need accounts to 
the script, which will greatly speed up the account creation process. 


Looking at for loops 


A for loop is rather different in its operation compared to while and until 
loops. The for loop does not test any conditions, but instead executes its 
commands for a certain number of list items. The basic syntax of the for loop is 
as follows: 


for variable in list 
do 

commands 
done 


When the for loop starts, variable (variable) is assigned the first item in the 
list's (list) value. The commands in the do/done construct are executed one 
time. The variable is then assigned the second list item's value, and the 
commands in the do/done construct are executed one time again. This continues 
until each list item's value has been assigned to the variable. 


A simple example of a for loop is shown in the showforloop.sh script here: 


$ cat showforloop.sh 
#!/bin/bash 
# 
# Demonstrate a for loop 
H#HHHHHHHHHHHHHHHHHHHHHHH 
# 
for Number in 1 2 3 
do 
echo $Number 
done 
# 
$ 


This script's for loop will process the commands in the do/done construct 
section for each list item. In this case, the list items are the numbers 1, 2, and 3. 
Here is the script in action: 


$ chmod u+x showforloop.sh 


A 


./showforloop.sh 


$ 
1 
2 
3 
$ 


You can see that the script assigns each item in the list to the variable Number. It 
then executes the command in the do/done construct. Because the command is 
echo $Number, the script's output shows the variable's value upon each iteration 
of the for loop. 


Poa 


Notice that all three loop types use the do/done construct to surround the 
commands that are executed within the loop. 


What is handy about the for loop is that you do not have to use numbers in your 
list. You can also use words, as shown here: 


$ cat showforloop.sh 
#!/bin/bash 
# 
# Demonstrate a for loop 
HEHEHE 
# 
for Pet in Cat Dog Bird 
do 
echo $Pet 
done 
# 
$ 
$ ./showforloop.sh 
Cat 
Dog 
Bird 
$ 


The seq command is another handy command to use with the for loop. It's great 
if you need a large amount of numbers in your list. Instead of typing in all the 
numbers, you can use the seq command. Its basic syntax is as follows: 


seq BeginningNumber IncrementAmount EndingNumber 


You don't have to include all of the parameters in the command. By default, 
BeginningNumber is assumed to be one (1), and the IncrementAmmount defaults 
to one (1). For instance, if you type seq 10, a list of numbers 1 through 10 is 
generated. Here are a few seq examples: 


$ seq 3 
1 
2 


seq 2 4 


seq 224 
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Using the showforloop.sh script, the for loop is modified to use a seq 
command as shown here: 


$ cat showforloop.sh 
#!/bin/bash 
# 
# Demonstrate a for loop 
H#HHHHHHHHHHHHHHHHHHHHHHH 
# 
for Number in $(seq 2 2 100) 
do 

echo $Number 
done 
# 
$ 


The seq command's results must be used in the for loop's list. Therefore, the seq 
command is encased in $(). Once the seq command's results are captured in the 
list, the for loop will iterate starting with the Number variable at 2. The Number 
variable will be incremented by 2 each time the loop iterates. The for loop will 
stop after the Number variable has been assigned 100, as a snipped output shows 
here: 


$ ./showforloop.sh 
2 

4 

6 

[...] 

98 

100 

$ 


Using loops and commands like seq allow a script's size to be reduced. Another 
construct that can reduce the number of shell script lines is a command list, 
which happens to be covered in the next section. 


Using Lists 


You can chain together commands using various list operators. This is called a 
list or a list of commands. You can use the following operators: 


e Semicolon (;) 

e Ampersand (&) 

e Double ampersand (&&) 

e Double vertical line or pipe (| |) 


You have already seen a few command list examples, such as this one used near 
the chapter's beginning: 


$ HOSTNAME=carson.example.com ; export HOSTNAME 


In the previous example, both the HOSTNAME variable setting and the export 
command are executed, but sequentially. In other words, when the HOSTNAME 
variable setting completes, then the export command executes. Another 
example that has output better demonstrates this order: 


$ date ; pwd 

Tue Oct 28 14:09:38 EDT 2015 
homeChristine 

$ 


You can see that the date command executes first and displays its STDOUT. 
When the date command is complete, then the pwd command executes, also 
displaying its STDOUT. Thus, the semicolon (; ) operator allows you to list two 
or more commands on the same command line. 


You can have your commands run almost simultaneously by using the 
ampersand (&) operator. As mentioned in Chapter 2, any command with an 
ampersand listed after it is sent to the background to execute. Commands 
without ampersands are run in the foreground. Using the previous example, here 
is what occurs when the ampersand operator is used, sending the date command 
to the background to execute while pwd executes in the foreground: 


$ date & pwd 

[1] 3276 

homeChristine 

$ Tue Oct 28 14:20:28 EDT 2014 
[1]+ Done date 
$ 


Even more powerful is the use of the double ampersand (&&) and double pipe 
(| |) symbols. With the double ampersand (&&), the second command is executed 
only if the first command completes successfully: 


$ dte && pwd 

-bash: dte: command not found 
$ 

$ date && pwd 

Tue Oct 28 14:23:00 EDT 2015 
homeChristine 

$ 


In the first command list shown in the previous example, an incorrect date 
command was mistyped as dte. Thus, it failed and therefore the second 
command, pwd, was not executed. However, in the second attempt, the correct 
command name, date, was entered. It ran successfully and allowed pwd to 
execute. 


With the double pipe (| |) operator, the second command will be executed only if 
the first command does not execute successfully. Using the date and pwd 
command example again, but with a double pipe operator, this time you can see 
that the pwd command executes only when the first command does not work 


properly: 


$ dte || pwd 

-bash: dte: command not found 
homeChristine 

$ 


$ date || pwd 
Tue Oct 28 14:28:00 EDT 2014 
$ 


The value of lists within a script is that you can streamline functionality. Going 
back to the mkuser.sh script, if a user did not have appropriate privileges to run 
the script, several errors would display. This is sloppy, as shown here: 


$ ./mkuser.sh Saffron 

./mkuser.sh: line 14: usrsbin/useradd: Permission denied 
Password for Saffron is being set... 

passwd: Only root can specify a user name. 

Here is Saffron's record: 

Account is ready for use. 

Leaving script... 

$ 


You can fix this by using a list with the useradd command. The required 
modification appears as follows: 


useradd $Username || break 


Besides useradd, there is an additional command added to the command list, 
break. If the useradd command does not work successfully, then the double 
pipe operator will trigger the break command, causing the while loop to 
terminate. This makes for a much cleaner-looking script execution when 
problems occur, as shown here: 


$ ./mkuser.sh Saffron 

./mkuser.sh: line 14: usrsbin/useradd: Permission denied 
Leaving script... 

$ 


That's much better! Now if an error occurs, the script displays the error message 
and exits immediately. 


Using Functions 


A function is a part of a script that performs a specific subtask and can be called 
by name from other parts of the script. Functions are defined by placing a set of 
parentheses () after the function name and enclosing the lines that make up the 
function within curly braces {}: 


function_name() { 
commands 
} 


The keyword function may optionally precede the function name. In either 
event, the function is called by name as if it were an ordinary internal or external 
command. 


Functions are very useful in helping to create modular scripts. Going back to the 
mkuser . sh script, we can put together a function that can be used throughout the 
script: 


# Function Declarations ### 

# 

err_function() { 
echo "An error has occurred!" 
echo "Exiting script immediately..." 
exit 


} 


This new function will help with the useradd command list. The original list 
looked like this: 


useradd $Username || break 


With the declared err_function function, the command list can look like the 
following: 


useradd $Username || err_function 


If the useradd command does not complete successfully, the err_function will 
be called. This allows for a great deal more flexibility in a shell script. 


PP 
grr 
Functions aren't run directly and in the order in which they appear in the 
script. They're run only when called in the main body of the script. 


To show the function in action, the mkuser.sh script will be run without enough 
privileges, as shown here: 


$ ./mkuser.sh Saffron 

./mkuser.sh: line 21: usrsbin/useradd: Permission denied 
An error has occurred! 

Exiting script immediately... 

$ 


That works great. You can now add all kinds of additional features, such as 
sending an email to the system administrator about this attempt and/or logging 
the attempt in the journal or a log file. 


Shell scripts are useful tools, and creating them requires practice. Exercise 9.2 
begins your exploration of shell scripts, but in the long run you'll need to learn to 
design your own shell scripts by doing more than copying examples from this 
book! 


Exercise 9.2 
Creating a Simple Script 


This exercise presents a shell script that gives you the option of using less 
to read every text file (with a name ending in . txt) in the current directory. 
To begin with this script, follow these steps: 


1. Log into the Linux system as a normal user. 


2. Launch a terminal emulator from the desktop environment's menu 
system if you used a GUI login method. 


3. Start an editor, and tell it to edit a file called testscript.sh. 


4. Type the following lines into the editor: 





#!/bin/bash 
for file in $(1ls *.txt) 


do 
echo -n "Display $file? " 


read answer 
if [ $answer == 'y' ] 
then 
less $file 


fi 
done 


Make sure you've typed every character correctly—any mistake may 
cause the script to misbehave. 


5. Save the file, and exit the editor. 
6. Type chmod u+x testscript.sh to add the executable bit to the file's 


permissions. 

7. Type ./testscript.sh to run the script. If there are no text (*. txt) 
files in your current directory, the script displays ano such file or 
directory error message, but if any text files are present, the script 
gives you the option of viewing each one in turn via less. 


This simple example script illustrates several important script features, such 
as variable assignment and use, for loops, and if-then conditional 


expressions. 





Managing Email 


Email is an important network service. Linux relies on email even in a 
completely non-networked environment. Certain Linux subsystems, such as 
cron (described in Chapter 7), may use email to notify you of activities. For this 
reason, most Linux distributions ship with email server software installed and 
configured for basic activities. You should understand the basics of email and be 
able to identify the specific email server package your system is running. 


Understanding Email 


Several protocols exist to manage email. The most common of these is the 
Simple Mail Transfer Protocol (SMTP), which is designed as a push mail 
protocol, meaning that the sending system initiates the transfer. This design is 
good for sending data, so SMTP is used through most of a mail delivery system. 
The final stage, though, often employs a pull mail protocol, such as the Post 
Office Protocol (POP) or the Internet Message Access Protocol (IMAP). With 
these protocols, the receiving system initiates the transfer. This is useful when 
the receiving system is an end user's workstation, which may not be powered on 
at all times or able to receive incoming connections. 


SMTP was designed to enable a message to be relayed through an arbitrary 
number of computers. For instance, an end user may compose a message, which 
is sent to the local SMTP server. SMTP servers are also known as Mail Transfer 
Agents (MTAs). The MTA looks up a recipient system and sends the message to 
that computer. This system may use its own internal routing table to redirect the 
message to another local computer from which the message may be read, either 
directly or via a POP or IMAP server. These servers are also known as Mail 
User Agents (MUAs). 


The basic steps for the creation, transfer, and delivery of email are as follows: 


1. A user creates an email message using an email client, called a Mail User 
Agent (MUA). 


2. The MUA gives the email to a Mail Submission Agent (MSA). 
3. The MSA then hands off the email to a Mail Transfer Agent (MTA). 


4. The MTA is responsible for transferring the email to the Mail Delivery 
Agent (MDA). 


5. The Mail Delivery Agent handles delivering the email to the Mail User 
Agent (MUA). 
6. The recipient user then reads the email message via the MUA. 
This arrangement is illustrated in Figure 9.1. Bear in mind that the number of 
links in this chain is variable and depends on how each system is configured. In 


the simplest case, local email stays on just one system. In theory, an arbitrarily 
large number of computers can be involved in an email exchange. 







User reads email 
using MUA 


User creates email 
using MUA 







User receives email 
using MDA 


User sends email 
using MSA 


Email is transferred 
using MTA 


Figure 9.1 Basic email transfer 


MTA can function as both a server (receiving mail from other systems) and a 
client (sending mail to other systems). Therefore, you must deal with both sides 
of the configuration equation. The primary focus in this chapter will be on 
email's MTA. 


Choosing Email Software 


Linux supports quite a few email MTA servers. Most likely, one of the major 
servers will be installed on your system by default. If not, and if you want to 
install one, you'll have to pick one. You may also want to change your email 
server if you need a more advanced configuration. Four email MTA servers are 
popular on Linux: 


Sendmail 


The sendmail program (www.sendmail.org) was for many years the 
dominant email server package on the Internet. It has lost some of its 


dominance to other servers. Nonetheless, sendmail remains a popular 
server. It's very powerful, but it can be hard to configure because its 
configuration file formats are rather difficult. 


Postfix 


Postfix (www. postfix.org) was designed as a modular replacement for 
sendmail. While sendmail uses a single program that does everything, 
Postfix uses multiple programs, each of which handles its own specific 
small task. This design improves security—at least in theory. Postfix tends 
to be easier to configure than sendmail, and it's become the default email 
server on many Linux distributions. 


Exim 


Although Exim (www.exim.org) is a huge server like sendmail, it has a 
much simpler configuration file format and so is easier to configure. A few 
Linux distributions use Exim as the default email server. 


Qmail 


The fourth major Linux email server, qmail (www. qmail.org), is a modular 
server with security as a major design goal. Like Postfix and Exim, qmail is 
easier to configure than sendmail. It's not often the standard email server in 
Linux distributions because its license is a bit strange and complicates 
qmail distribution with Linux. However, many system administrators like 
qmail enough that they replace their distributions’ standard email servers 
with qmail. 


oa 


These email service packages may also provide additional services besides 
MTA. For example, they may also provide MSA services. 


You have several ways to learn which email MTA server your Linux distribution 
runs. The two most reliable are to use ps (described in Chapter 2, “Managing 
Software”) to look for running processes or to use your package management 
tools (also described in Chapter 2) to see which package is installed. In either 
case, you may need to check for each of the programs in turn. For example, you 
might see results like these: 


$ ps ax | grep sendmail 


31129 pts/2 R+ 0:00 grep sendmail 
$ ps ax | grep postfix 

7778 ? Ss 0:45 usrlib/postfix/master 
31132 pts/2 S+ 0:00 grep post 


The search for a process containing the string sendmail failed, but the search for 
postfix returned a process called usrlib/postfix/master. Thus, it appears that 
Postfix is running on this system. 


z= 


Keep in mind that your distribution may not have an email MTA server 
installed by default. In that case, if you desire to work with one, you will 
need to choose a server from the list presented earlier and install it using 
your Linux distribution's package management tools (see Chapter 2). 


You can also look for executable files for each email MTA server in usrbin or 
usrsbin. Be aware that many Linux email servers include a program called 
sendmail. This program is not the sendmail program discussed earlier, but 
instead an interface to other email servers. This is done for compatibility 
reasons, because the original sendmail program was in many distributions. Also, 
it provided a compatible interface for scripts and administrators’ helps for other 
email servers. This program is one of the sendmail emulation layer commands. 


Working with Email 


Along with understanding which email MTA server your system has or which 
one you desire to install, you also need to know how to complete a few common 
administrative tasks. These tasks involve sending and receiving mail using the 
mail utility, email queue management, configuring aliases, and forwarding 
email. 


Sending and Receiving Email 


Linux supports a wide variety of email clients, some of which were mentioned 
earlier in “Choosing Email Software.” Chances are that you'll use a full-fledged 
email client for your personal email. However, you should also know how to use 
the command-line—based mail program. This tool is a very basic command-line 
email utility. It has the advantage of being usable from a script. Therefore, you 
can write a script to handle some email tasks automatically, and perhaps even 
run that script automatically. 


The mail program is intended to be used on the command-line to send or receive 
messages. The basic syntax for mail, including its most useful options for 
sending email, is as follows: 


mail [-v] [-s subject] [-c cc-address] [-b bcc-address] to-address 


The basic syntax for receiving email is as follows: 


mail [-v] [-f [name] | -u user] 


A 


2 


Unlike most email readers, the mail command supports reading only the 
local email queue, not email stored on remote servers and read via the POP 
or IMAP protocols. 


You can achieve various goals with the options to mail: 
Use Verbose Operation 


As with many commands, the -v option produces more verbose output. 
This may be helpful if you need to debug problems. 


Specify a Subject Line 
The -s subject option enables you to specify a subject line. 
Set a Carbon Copy Address 


You can send a message to multiple people by using the -c cc-address and 
-b bcc-address options. These options vary in that the -b option produces 
a “blind” copy, meaning the recipient's address doesn't appear in the 
address list. This is useful if you want to send a copy of an email discreetly 
to somebody, but some spam filters may delete such emails. 


Set the Recipient's Address 


The main recipient's email address is required and terminates the mail 
command's line for an outgoing email. 


Read Email 


To read your email, optionally pass the -f option to the program followed 
by the name of the mail spool file. Alternatively, you can use the -u user 
option to read the mail of the specified user. 


This list of options is incomplete, but it includes the most important features. 
You should consult the man page for mail to learn about more unusual options. 


Z 


If you want to try out these mail commands but your Linux system does not 
have a working email MTA server and you do not want to (or cannot 
because you are not the administrator) set up an email server, try an older 
distribution. Old Fedora distributions, such as Fedora 13, often have 
sendmail already configured. If you have an old computer lying around, you 
can install the older distribution there, or install it within free virtualization 
software, such as VMPlayer or VirtualBox. 


As an example of mail in action, consider the task of sending a quick email 
message. Here's an example of a test email: 


$ mail -s "Test email" Christine 
This is a test email. 

EOT 

$ 


After you type the mail command, the program waits for input via standard 
input, but there's no prompt. You signal the end of the message by pressing 
Ctrl+D. This example shows a simple one-line message. After you press Ctrl+D, 
the program displays EOT, which stands for End of Transmission, and the 
message is on its way. 


To use mail in a script, you can use input redirection to pass it the contents of a 
file to be mailed: 


mail -s "Automated alert!" < tmpalert.txt john 


This line, if included in a script, sends the contents of the tmpalert.txt file to 
the user john with the “Automated alert!” subject line. 


You can use mail to read incoming email too, but only if it's stored on a local 
Linux mail spool. In this case, you'll normally use mail interactively. Type mail, 
and you'll see the contents of your mail spool. Each message has a summary line 
that lists the sender, date, and subject, among other things: 


0046 sally@luna.edu Sun Jan 13 18:27 116/4262 Priorities 


This is message number 46, it's from sally@1luna. edu, it arrived on January 13 
at 18:27 (6:27 p.m.), it has 116 lines and 4262 bytes (including headers), and its 
subject is Priorities. 


To read a message, type its number. You can then delete the message by typing d 
or reply to it by typing r. 


As a practical matter, most people prefer to use more sophisticated email readers 
for their day-to-day mail reading. You'll probably find mail more useful for the 
scripted sending of email than for reading email or sending personal email. 


On Linux, email is tied intricately to user accounts. The mail server holds 
incoming messages for each user, typically in a file in the varspool/mail/ 
directory. For instance, the file that holds the mail for the user john is the 
varspool/mail/john file. Some email servers store incoming mail in users' 
home directories, such as ~/Maildir. This incoming mail file or directory is 
referred to as the user's mail spool. 


ghi 
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You may recall that the userdel command, described in Chapter 7, includes 
options related to handling users' mail spools. If you delete a user account 
but leave the user's mail spool intact, the mail can still be accessed. If the 


mail server software stores mail in varspool/mail, leftover mail spools can 
cause problems if you eventually reuse an old username. 


Checking the Email Queue 


An email server manages a queue of email messages that it must deliver. The 
email server sends email messages to another computer or stores them in local 
users' mail spools. Various problems can lead to a temporary or permanent 
inability to deliver messages. When a problem seems to be temporary, such as a 
network routing failure, the email server must store the message and try to 
deliver it again later. Thus, a Linux server's email queue may contain 
undelivered messages. Knowing how to identify these messages and manage the 
queue can help you keep your email subsystem working smoothly. 


The mailg program is the main tool to help in email queue management. This 
program was originally part of the sendmail package, but Postfix, Exim, qmail, 
and other Linux MTA servers have all implemented compatible commands. 
Unfortunately, command options differ between implementations. The basic 
command, without any options, shows the contents of the email queue on all 
systems: 


$ mailq 
-Queue ID- --Size-- ---- Arrival Time---- -Sender/Recipient------- 
5B42F963F * 440 Fri Jan 18 13:58:19 sally@example.com 


benf@luna. edu 
-- © Kbytes in 1 Request. 


This example, taken from a system running Postfix, shows one message in the 
queue along with relevant identifying information. The exact display format 
varies from one MTA server to another. In most cases, typing mailq is 
equivalent to typing sendmail -bp. 
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If your system uses a different MTA than sendmail, often the sendmail -bp 
command will still work. This command is often implemented as a sendmail 
emulation layer command. You can see all the various sendmail emulation 
layer commands available on your system by typing man sendmail at the 
command-line. 


If a network connection or upstream email server goes down temporarily, email 
messages can pile up in the queue. Your MTA server will ordinarily attempt 
redelivery at a later date. However, if you want to clear the queue, you can do so. 
Typing sendmail -q will do the job with most MTA servers. Some have other 
equivalent commands, such as post queue in Postfix or rung in Exim. 


All email servers offer a wide variety of advanced options to prioritize email 
delivery, accept messages on the command line, debug email connections, and 
so on. Unfortunately, commands and procedures to use these features vary from 
one email server to another. You should therefore consult your server's 
documentation to learn how to use these features. 


Redirecting Email 


Email aliases enable one address to stand in for another one. For instance, all 
email servers are supposed to maintain an account called postmaster. 
Somebody who's responsible for maintaining the system should read email to 
this account. One way to do this is to set up an alias linking the postmaster 
name to the name of a real account. You can do this by editing the aliases file, 
which usually resides in /etc or sometimes in etcmail. 


The aliases file format is fairly straightforward. Comment lines begin with 
hash marks (#), and other lines take the following form: 


name: addressi[,address2[,...]] 


The name parameter that leads the line is a local name, such as postmaster. Each 
address (addressi, address2, and so on) can be one of the following: 


e A local account name to which the messages are forwarded 


e A local file name in which messages are stored (denoted by a leading slash) 


e A command through which messages are piped (denoted by a leading 
vertical bar character) 


e A file name whose contents are treated as a series of addresses (denoted by 
a leading :include: string) or a full email address (such as 
fred@example.com) 


A typical default configuration includes a few useful aliases for accounts such as 
postmaster. Most such configurations map nearly all of these aliases to root. 
However, reading mail as root is inadvisable because doing so increases the 
odds of a security breach or other problems due to mail reader bugs. Thus, you 
may want to set up an alias line as follows: 


root: username 


This redirects all of root's mail, including mail directed to root via another 
alias, username. The username value is most likely to be a local username or a 
valid remote email address. However, it can take any of the forms described 
earlier. 


Some mail servers, including sendmail, Postfix, and qmail, require you to 
compile etcaliases into a binary file before an alias will take effect. To do so, 
use the newaliases command: 


# newaliases 


Exim has a newaliases command for compatibility with sendmail. By default, 
however, it doesn't do anything. 
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You should always test out an alias after you make modifications to the alias 
configuration file. If it doesn't work, you may have forgotten to run the 
newaliases command! 


Another approach to redirecting mail is to do so at the user level. In particular, 
you can edit the ~/. forward file in a user's home directory to have mail for that 
user sent to another address. Specifically, the ~/. forward file should contain 
only the new address. This address can be either a username on the current 
computer or an entire email address on another computer. 


Forwarding email has the advantage that individual users can employ it. It's also 
handy in situations such as when a user scheduled to be away for several weeks 
asks another employee to fill in for them. 


A drawback of forwarding email is that it can't be used to set up aliases for 
nonexistent accounts or for accounts that lack home directories. The ~/. forward 
file can also be changed or deleted by the account owner, which might not be 
desirable if you want to enforce a forwarding rule, which the user shouldn't be 
able to override. 


Managing Data with SQL 


The Structured Query Language (SQL), as its expanded name suggests, is a 
language used for retrieving data from a database. In practice, SQL is 
implemented in several different database products. Thus, you should know a 
little about the SQL products that are available for Linux. With a SQL package 
installed, you can begin learning about the principles of using SQL and move on 
to actual data storage and retrieval. 


Picking a SQL Package 


SQL is a language for accessing data, and specific SQL packages implement that 
language. This distinction is similar to the one between a network protocol (such 
as SMTP) and the servers that implement it (such as sendmail, Postfix, and 
Exim). In principle, you can use any SQL package to satisfy your SQL database 
needs. In practice, specific products that store data using SQL may work better 
with (or even require) particular packages. The following products are among 
the common choices in Linux: 


MySQL 


Oracle owns this SQL implementation, which has been released under the 
GPL. Most major Linux distributions include MySQL in their package 
databases. For a complete installation, you'll probably need to install 
multiple packages, such as a client, a server, and perhaps development 
tools. You can learn more at www. mysql.com. 


PostgreSQL 


This SQL implementation evolved from the earlier Ingres software (the 
name PostgreSQL is a compressed form of post-Ingres SQL). It's available 
under the BSD license and is available as multiple packages in most Linux 
distributions. As with MySQL, you'll most likely have to install a client, a 
server, and perhaps additional support packages. PostgreSQL is 
headquartered at www. postgresql.org. 

SQLite 

This package, based at www. sqlite. org, is a library that implements SQL. 


As such, it's not a stand-alone database; instead, it's intended to provide 
programs with a way to store data using a SQL interface within the 


program. If you install a program that uses SQLite, your distribution's 
package manager should install the relevant libraries for you. If you want to 
write a program that requires database access and you don't want to install a 
complete client-server SQL package such as MySQL, SQLite may be just 
what you need. 


There are dozens more SQL database products for Linux. For the purpose of 
learning SQL, MySQL or PostgreSQL should do fine. If you have a specific 
purpose in mind for using SQL, though, you should research SQL packages in 
more detail. You may need a particular product for compatibility with other 
software, or you may need a SQL package that provides specific features. 


As just noted, some SQL packages, including MySQL and PostgreSQL, operate 
on a client-server model: One program (the server) manages the database, while 
another (the client) provides users and programs with access to the database. 
Such implementations can work over a network, enabling users at multiple client 
systems to access a centralized database server. 


Understanding SQL Basics 


SQL is a tool for accessing databases, and more specifically, relational 
databases. Figure 9.2 illustrates data in a relational database. Each row 
(sometimes known as a tuple) represents a single object or other item, and each 
column (sometimes referred to as an attribute or field) represents a specific 
feature. The combination of rows and columns is referred to as a table. Each 
database may contain multiple tables, and SQL supports multiple databases. 
Thus, to access data, you must first select a database and a table, as described in 
more detail shortly. 


attributes (columns) 


Figure 9.2 A relational database stores data in a table, with each row 
representing one object or item and each column representing specific attributes. 





The table data is unordered, at least conceptually. You can impose an order on 
query results, as described shortly. For example, you may retrieve data from the 
database represented by Figure 9.2 and order the results according to cost (the 
final column). 


A database enables retrieval of information that matches specific criteria. You 
can search for all of the green objects in Figure 9.2, for instance. You can also 
insert, delete, and update information in a table. SQL supports multiple tables, so 
you can have, for example, different tables for office property and for employees 
who work in your office. 


Columns (attributes) in a database hold specific types of data, and swapping 
them around makes little sense. For instance, it's clear that the second column in 
Figure 9.2 is a color, whereas the final column is a price or value, expressed in 
dollars. It wouldn't make sense to enter green as a price or $1.00 as a color. The 
restrictions placed on what may appear in a column are known as a domain or a 
data type. The domain for the second column is a set of color names, whereas 
the domain for the final column is a numeric value expressed in dollars. Table 
9.3 summarizes some common SQL data types. 


Table 9.3 Common SQL data type 


Data Purpose 


Type 
Name 


INTEGER 4-byte integer value 
(aka INT) 


SMALLINT 2-byte integer value 

DECIMAL Precision storage of decimal values 
NUMERIC Precision storage of decimal values 
FLOAT Floating-point number 


DOUBLE Floating-point number stored with twice the precision of FLOAT 
PRECISION 


DATETIME A date and time 


DATE A date 

TIME A time, in HH:MM:SS format; may be a time of day or a period of 
time 

CHAR One or more characters 


VARCHAR A variable number of characters 
ENUM An enumerated list, such as small, medium, or large 


SET Data that may have zero or more values, as in any of the set of nuts, 
sprinkles, fudge, and cherry for ice cream toppings 


Additional data types exist. Table 9.3 is intended to give you a feel for what's 
available and to list some of the data types you're likely to encounter. Some 
implementations also support unique data types. Each of these data types has its 
own features. For instance, mathematic operators can manipulate the numeric 
data types (INTEGER, DECIMAL, and so on). 


Using MySQL 


To learn about SQL, you should have access to a SQL database. For purposes of 
demonstration, the MySQL package is used as a reference in this discussion. 
Other SQL implementations are similar to what is described here, but some 
details differ. One of these details is how to start the database. In the case of 
MySQL, your distribution should include a SysV or other startup script for the 


CAT cnamrar Thie carrar mar nalon nand ta ha nanfimnrand vrith ite nrm rant 
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password. Debian and related distributions will prompt for this when you install 
the package, but you may need to set this manually with other distributions. 
Starting to Use MySQL 


To begin a SQL session, you should first ensure that the server is running, as just 
described. You can then start the SQL client. In the case of MySQL, this 
program is called mysql: 


$ mysql 


If you've just installed MySQL for learning purposes, it may have no databases 
defined. To learn what's defined, you can use the SHOW DATABASES command: 


mysql> SHOW DATABASES; 


eae ee eee + 
| Database | 
e E pa es + 
| information_schema | 
plea ake ems Sp Sites + 


1 row in set (0.00 sec) 


pa 


This example illustrates an important feature of SQL: Commands are 
terminated by semicolons (; ). There are a few exceptions to this rule, but if 
you forget the semicolon, you're likely to see a new prompt that reads -> 
rather than mysql>, at least in MySQL. You can use this fact to split your 
commands across multiple lines, if you like. If you forget the semicolon that 
terminates a command, you can enter it by itself on the -> prompt line. 


In this example, one database is already defined: information_schema. Some 
installations define a database called test. If you see such a database, you can 
probably use it for your own tests. However, other users may be able to see and 
modify the test database, so don't store important data in it. 


A JTE 


AA 


SQL commands are conventionally shown in uppercase. However, SQL 
commands are case insensitive, so you can type your commands in 
uppercase, lowercase, or any mixture of case you like. 


Creating Databases and Tables 


If no database for testing purposes exists, you can create one with the CREATE 
DATABASE command, which takes a database name as an option: 


mysql> CREATE DATABASE test; 
Query OK, 1 row affected (0.00 sec) 


z= 


Although SQL commands are case insensitive, database names are not. 
Thus, be sure to create the database name using whatever case you intend to 
use to refer to it in the future. 


If you type SHOW DATABASES, you'll see the test database in addition to any that 
already existed. Regardless of whether test existed when you first started 
MySQL or it had to be created, you can begin using it with the USE command: 


mysql> USE test; 


Within each database, tables must be created and selected for use. The 
commands to do so are similar to the commands used to create and select 
databases. In a newly created database, no tables exist: 


mysql> SHOW TABLES; 
Empty set (0.00 sec) 


The response Empty set denotes an empty database. To fill the database with 
data, you must first decide on a table structure—what sort of data you want to 
record. For instance, Figure 9.2 shows various attributes of common objects: 
their names, colors, sizes, hardness levels, and values in dollars. To create a table 
that includes columns for these five attributes, you use a CREATE TABLE 
command, passing it various details: 


mysql> CREATE TABLE objects (name VARCHAR(30), color VARCHAR(20), 
-> size FLOAT, hardness ENUM('soft', 'medium', 'hard'), 
-> value DECIMAL(10,2)); 

Query OK, 0 rows affected (0.01 sec) 


This example creates a table with five columns: name, color, size, hardness, 
and value. Each column has an associated data type, as described in Table 9.3. 
A few points worth noting about this table definition are as follows: 


e The name and color columns are both VARCHAR data type (see Table 9.3) 
examples, but with different sizes. The name field may be up to 30 
characters, whereas color may be up to 20 characters. If these were defined 


as CHARs, each name would have to be precisely 30 characters in size, with 
each color precisely 20 characters. A limited set of colors can be specified 
using an ENUM data type rather than a VARCHAR data type. Presumably you 
wouldn't want to limit object names this way. 


e The size column is a FLOAT data type, which is less precise than an integer 
data type, but it can hold real (non-integer) numbers. Figure 9.2 includes 
sizes in inches and feet, but in practice you'll need to convert everything to 
one unit—probably inches in this case. 


e Note the syntax for defining the ENUM data type: the list of values as a whole 
is enclosed in parentheses (()), and each enumerated value is enclosed in 
single quotes (') and separated from other values by a comma (, ). 


e The DECIMAL value includes a specification of the number of digits (10 in 
this example) and the number of digits after the decimal point (2 in this 
example), separated by a comma. Some implementations support a MONEY 
data type that can be used in this case, but MySQL lacks this data type, so 
DECIMAL is the best choice for the job. A DECIMAL type is better for currency 
than FLOAT because a FLOAT type is likely to introduce rounding errors 
because of the way numbers are encoded in a FLOAT value. Such errors are 
typically unacceptable in currency, although they may be tolerable in some 
applications. 


If you need to create a table with other types of values, you should consult the 
documentation for your specific SQL implementation to see what data types it 
supports. 


With the table created, you may want to verify that it's been created correctly. 
You can do so by typing the DESCRIBE objects; command. The result should 
be a summary of the fields that you've just created for the objects table. 


Storing Data 


You can now begin to store data in your database. To do so, use the INSERT 
INTO command: 


mysql> INSERT INTO objects 
-> VALUES('lizard', 'green',6, 'soft',10.00); 


This example creates an entry for the first row of Figure 9.2 (but with one piece 
of incorrect data, which is deliberate). You can verify that the database now 
holds this information by typing the SELECT * FROM objects; command. The 


result is a listing of all of the data in the objects table, which in this case should 
be just the one entry. (The next section, “Retrieving Data,” covers data retrieval 
in more detail.) 


This example entered incorrect data for one field: The lizard is entered in the 
table as being 6 inches in size rather than 5. You can correct this error by using 
UPDATE: 


mysql> UPDATE objects SET size=5 WHERE name='lizard'; 
Query OK, 1 row affected (0.00 sec) 
Rows matched: 1 Changed: 1 Warnings: 0 


This example begins with the keyword UPDATE and the table name (objects). 
The example then tells MySQL what to update: SET size=5. In other words, set 
the size field to 5. The WHERE keyword begins a specification of which rows to 
change. In this case, with only one row present, you can use any data or even 
omit WHERE, along with the rest of the line up to the semicolon. In most cases, 
though, you must provide enough criteria to identify the column uniquely that 
you want to change. In this example, the name of the object is used—hence 
name='lizard', which tells MySQL to change the data for all rows for which 
the name field is lizard. 


Before you continue with data retrieval activities, you should complete a 
database. Exercise 9.3 will guide you through this process. 


Exercise 9.3 


Creating a SQL Database 





In this exercise, you'll continue creating a small database. This exercise 
assumes that you've performed the steps described in “Creating Databases 
and Tables” and “Storing Data” and that you therefore have a SQL database 
called test that contains a table called objects, which contains one entry 
based on the first line in the matrix in Figure 9.2. 


To complete this database, follow these steps: 


1. If you're not currently running MySQL, do so by typing mysq1 or 
whatever command you use to access your MySQL databases. 


2. If you're not already using the test database, type USE test; to begin 
using the test database. 


3. Type INSERT INTO objects VALUES('tree', 'green', 120, 


'medium', 200);. (You may split this command across lines if you 
like.) This entry is based on the second row of Figure 9.2, but note that 
the size value has been expressed in inches. 


4. Verify that you entered the data correctly by typing SELECT * FROM 
objects; and verifying that the new entry is present. 


5. Repeat step 3 (and step 4, if you like) for the remaining rows in Figure 
d2. 


If you like, you can continue and enter more data; however, if you do so, 
some subsequent examples may not work as described. 





Retrieving Data 


The whole point of having a database is to be able to retrieve data from it. The 
main command for doing so has already been described: SELECT. This 
command's power lies in its ability to accept specifications of what to select. 
You can use a variety of keywords to select data that match various criteria. 
These include exact matches or matches to a range of values. The overall form 
of SELECT can be described in this way: 


SELECT field(s) FROM table [ WHERE conditions ] [ORDER BY field] 


Previous examples of SELECT have used an asterisk (*) as field(s), meaning 
that the command returns all of the columns that match the remaining criteria. 
You can instead specify columns by name. For instance, suppose you're 
interested only in the colors and values of objects. You can view this restricted 
set of data using SELECT: 


mysql> SELECT value,color FROM objects; 


passeras Pes anes + 
| value | color | 
pasesaan panke + 
| 10.00 | green | 
| 200.00 | green | 
| 5.00 | white | 
| 1.00 | red | 
| 0.10 | yellow | 
poe anaes s PAS soeses + 


5 rows in set (0.00 sec) 


The field(s) criteria appear as a comma-separated list of columns. In this 


example, the criteria were listed in the reverse order from their database order, 
and so they appear in the reverse order in the output. 


A more interesting way to retrieve data is to use WHERE conditions. This tool 
has already been mentioned in reference to updating data. You can use 
conditions to retrieve specific data in several ways: 


Exact Matches 


Using a column name, an equal sign, and a value to match returns only for 
those rows that match the specified value. For instance, typing SELECT * 
FROM objects WHERE color='green'; returns the two entries for green 
objects (lizard and tree). 


Numeric Tests 


You can retrieve data that match certain numeric criteria. For instance, to 
retrieve data on all objects that are greater than 10 inches in size, you can 
type SELECT * FROM objects WHERE size>10;. 


Alphabetic Tests 


The greater-than (>) and less-than (<) operators work on letters as well as 
numbers. This fact can be used to retrieve data based on the first letter of a 
string. For example, type SELECT * FROM objects WHERE name>'b'; to 
retrieve records where the name begins with b or later letters in the alphabet. 
(Although this example uses a greater-than operator, it does in fact match 
the letter b.) 


Multiple Tests 


You can combine multiple criteria using the AND and OR operators. For 
instance, to retrieve data on soft objects valued at more than $7.50, you can 
type SELECT * FROM objects WHERE hardness='soft' AND 
value>7.50;. 


You can have MySQL return the data as an ordered list by specifying a field 
name after the ORDER BY keyword: 


mysql> SELECT * FROM objects WHERE hardness='soft' ORDER BY value; 


ee S priben Facchi ne Farasin + 
| name | color | size | hardness | value | 
pes eeraS Paan ianua Fiarass PEE E EEE Foaatama + 
| banana | yellow | 8 | soft | 0.10 | 
| pillow | white | 18 | soft | 5.00 | 
| lizard | green | 5 | soft | 10.00 | 


Posse eas a PS aess fa seas aes Perse nie + 
3 rows in set (0.00 sec) 


Combining Data from Multiple Tables 


As noted earlier, a database may contain multiple tables. This feature of SQL 
enables you to create tables for different functions. For instance, Figure 9.2 
might represent a database of object characteristics that are of interest to you. 
You might also have a database containing objects' locations and conditions (on 
a 10-point scale), as shown in Table 9.4. Occasionally, you may need to combine 
these two tables to create a master table on which you can perform queries. For 
you to do so, the two tables must have one matching field. This matching field is 
used to bind the two tables together. In addition, each table must have one field 
whose value uniquely identifies each row. This uniquely identifying field is 
known as a primary key. In the case of Figure 9.2, the first column (called name) 
can serve as a primary key. In the case of Table 9.4, the Object ID column will 
do the job. 





Table 9.4 Data on object locations and conditions 


Object ID Object name Location Condition 


1 banana kitchen 9 
2 banana kitchen 8 
3 tree backyard 2 
4 brick garage 10 
5 brick garage 9 
6 brick backyard 9 
7 lizard living room 8 


You can create this table much as you created the first one: 


mysql> CREATE TABLE locations (id INTEGER, name VARCHAR(30), 
-> location VARCHAR(30), cond INTEGER); 
mysql> INSERT INTO locations VALUES(1, 'banana', 'kitchen', 9); 


Additional INSERT operations will fill out the table. At this point, you can use the 
SELECT operator to select data based on fields from both tables. For instance, 
suppose you want to know where all of the green objects are located. The first 
table (objects) contains color data but not locations, whereas the second table 
(locations) holds locations but not color data. You can accomplish the goal by 


using a few tricks: 


mysql> SELECT objects.name, objects.color, locations.location 
-> FROM objects, locations 
-> WHERE objects.name=locations.name AND objects.color='green'; 


es a E E E + 
| name | color | location | 
ees fe as eens is Se ee + 
| tree | green | backyard | 
| lizard | green | living room | 
poe Seas Fens sae PLCS pas erases + 


2 rows in set (0.00 sec) 


MySQL automatically combines the two tables and produces output based on the 
criteria you specify. The final output in this example includes the name, color, 
and location of the objects, even though each table has just two of those three 
values. 


A second way to combine data from multiple tables is to use JOIN. This 
approach is very similar to the preceding one, but you specify one table using 
FROM and the other using JOIN: 


mysql> SELECT objects.name, objects.color, locations.location 
-> FROM objects 
-> JOIN locations 
-> WHERE objects.name=locations.name AND objects.color='green'; 


Combining data lets you simplify the structure of your database in certain 
situations. The examples used here illustrate this fact. The data in the objects 
table describes objects generically, whereas the data in the locations table 
describes objects specifically. This design enables each table to be relatively 
small. If all of the data were stored in a single table, that table would require 
multiple entries for each item, duplicating a lot of data. By splitting the data 
across tables, each table can be much smaller, thus reducing storage space. 


A retrieval command that requires special mention is GROUP BY. This command 
is used in conjunction with mathematical operators, such as SUM( ), to restrict the 
selection to specified columns. For instance, suppose you want to know the total 
value of all of the objects in the database, grouped by object type. You can do as 
follows, combining data from both tables: 


mysql> SELECT objects.name, objects.value, SUM(value) 
-> FROM objects, locations 
-> WHERE locations.name=objects.name 


-> GROUP BY value; 


The result is a summary of the values of all of the objects by type. Omitting the 
GROUP BY clause produces an error message in MySQL. 


Deleting Data 


Sometimes your data need to be deleted. ‘Table 9.4 suggests that the tree in the 
backyard is ill—its condition rating is just 2 on a 10-point scale. Perhaps you'll 
decide to cut it down and therefore remove it from the locations database. To 
do so, you'll use the DELETE command, which takes the following form: 


DELETE FROM table WHERE conditions 


For instance, to delete that now-removed tree, you can type the following 
command: 


mysql> DELETE FROM locations 
-> WHERE name='tree' AND location='backyard' ; 
Query OK, 1 row affected (0.05 sec) 


In this specific case, the WHERE condition is more detailed than it needs to be. 
This is because the backyard tree is the only one in the table. As usual, when 
deleting any sort of data on a computer, though, it's better to be overly cautious 
than sloppy. 


Z 


Before deleting data, try using SELECT to see what data your WHERE 
conditions match. Doing this will help you to avoid accidentally deleting too 
much data. 


You can delete all of the data from a table by using a variant of the DELETE 
command: DELETE * from locations;. This command deletes all of the table's 
data without deleting the table itself. This may be useful if the table is hopelessly 
messed up from experimentation. An even more drastic deletion operation is 
DROP: DROP TABLE locations;. This example completely eliminates the 
locations table. Naturally, this is an extremely dangerous command, but you 
may want to use it when cleaning up your own SQL practice session. 


Learning More about SQL 


SQL is a very complex topic, and this chapter can only scratch the surface. For 
more information, you should read more from various sources. Your own SQL 
package's documentation can be a good starting point, particularly if you need to 
use features that are unique to your implementation. Books on SQL, such as 
Alan Beaulieu's Learning SQL, 2nd Edition (O'Reilly, 2009) and Larry 
Rockoff's The Language of SQL (Cengage Learning, 2010), are also worth 
reading if you need to do more than trivial SQL work. 


Summary 


Linux administrators must have at least a basic understanding of shell scripts. 
Many configuration and startup files are in fact shell scripts. Being able to read 
them, and perhaps to modify them, will help you administer your system. Being 
able to create new shell scripts is also important because doing so will help you 
simplify tedious tasks and create site-specific tools by putting together multiple 
programs to accomplish your goals. 


Email server administration is another task with which you must have at least a 
passing familiarity. Although most Linux systems don't operate as full-blown 
email servers, most Linux installations do include email servers for processing 
locally generated email. You can configure email forwarding and perform a few 
other tweaks without delving too heavily into email server configuration. 


The final topic of this chapter, SQL use, will help you manage simple databases 
stored using the Structured Query Language (SQL). Many programs rely on 
SQL for their operation, so being able to perform simple SQL queries will help 
you work with these programs. You may even decide to set up databases to help 
manage your own tasks, such as tracking computer equipment. 


Exam Essentials 


Explain the function of environment variables. 


Environment variables are used to store information on the system for the 
benefit of running programs. Examples include the PATH environment 
variable, which holds the locations of executable programs, and HOSTNAME, 
which holds the system's hostname. 


Describe various shell script components. 


A shell script combines several commands, possibly including conditional 
expressions, variables, and other programming features. A shell script must 
Start with a shebang line to let the kernel know it is a script and indicate the 
shell interpreter to use. Each script component has a specific syntax needed 
for proper shell execution and logic flow. A shell script is run using various 
methods. Each method may or may not create a subshell and may or may 
not require the execution bit to be set. 


Describe the purpose of shell aliases. 


Aliases enable you to create a command “shortcut”—a simple command 
that can stand in for a different or longer command. Aliases are typically 
defined in shell startup scripts as a way to create a shortened version of a 
command. Aliases also allow useful command options to be used as the 

new default or they create an easier-to-remember version of a command. 


Summarize the major SMTP servers for Linux. 


Sendmail was the most common SMTP server a decade ago, and it is still 
very popular today. Postfix and Exim are often supplied as the default mail 
servers on modern distributions, whereas administrators sometimes install 
qmail. Postfix and qmail use modular designs, whereas sendmail and Exim 
do not. 


Explain the difference between an email alias and email forwarding. 


An email alias is configured system-wide, typically in etcaliases. It can 
set up forwarding for any local address, even if that address doesn't 
correspond to a real account, and if the system is properly configured, only 
root may edit etcaliases and therefore modify aliases. Email forwarding, 
on the other hand, is handled by the ~/. forward file in a user's home 


directory; it is intended as a means for users to control their own email 
forwarding without bothering the system administrator. 


Summarize the structure of a SQL database. 


Each SQL installation consists of a number of named databases, each of 
which in turn may contain multiple tables. Each table can be thought of as a 
two-dimensional array of data. Each row in a table describes some object or 
concept (inventory items, employees, movies in a personal DVD collection, 
and so on), and each column in a table holds data about these objects or 
concepts (model number, salary, or director, for example). 


Describe the commands used to enter data in a SQL database. 


The INSERT command inserts a single entry into a database. It requires a 
table name and a set of values, as in INSERT INTO movies 
VALUES('Brazil', 'Terry Gilliam', 1985);. The UPDATE command can 
be used in a similar way to update an existing entry, but you must use SET 
to specify the column to set and WHERE to identify the row or rows to be 
modified. 


Explain the commands used to extract data from a SQL database. 


The SELECT command retrieves data from a SQL database. It can be used 
with a variety of additional options, such as FROM, JOIN, and WHERE, to 
identify the table or tables from which data should be retrieved and to 
locate specific values of interest. 


Review Questions 


1. Which environment variable stores the format for the command prompt? 
A. PROMPT 
B. PSI 
C. PAGER 
D. PS1 
E. None of these variables store the format for the command prompt. 


2. You want to create a shortcut command for the command cd 
~/papers/trade. Which of the following lines, if entered in a bash startup 
script, will accomplish this goal? 


A. alias cdpt='cd ~/papers/trade' 
B. export cdpt='cd ~/papers/trade' 
C. alias cdpt 'cd ~/papers/trade' 
D. alias cd 'cdpt ~/papers/trade' 
E. env cdpt “cd ~/papers/trade- 
3. What is the purpose of the EDITOR environment variable? 


A. If it's set to Y (the default), the shell environment permits editing of 
commands; if it's set to N, such editing is disallowed. 


B. It specifies the filename of the text editor that bash uses by default while 
you're entering commands at its prompt. 


C. If you type edit filename at a command prompt, the program specified by 
EDITOR will be launched. 


D. If it's set to GUI, programs call a GUI editor; if it's set to TEXT, programs call 
a text-based editor. 


E. Some programs refer to EDITOR to determine what external editor to launch 
when they need to launch one. 


4. In what environment variable is the current working directory stored? 


A. PATH 


B. CwD 
C. PWD 
D. PRESENT 
E. WORKING 


5. If typed in a bash shell, which of the following commands will create an 
environment variable called MYVAR with the contents mystuff that will be 
accessible to any created subshells? (Choose all that apply.) 


A. export MYVAR='mystuff' 
B. MYVAR='mystuff' 
C. MYVAR='mystuff'; export MYVAR 
D. echo $MYVAR mystuff 
E. setenv MYVAR mystuff 
6. What file might a user modify to alter their own bash environment? 
A. etcinputrc 
B. etcbashrc 
C. $HOME/bashrc 
D. $HOME/.profile_bash 
E. ~/.bashre 


7. What commands might you use (along with appropriate options) to learn the 
value of a specific environment variable? (Select two.) 


A. env 

B. DISPLAY 
C. export 
D. echo 

E. cat 


8. Immediately after creating a shell script called a_script.sh in a text editor, 
which method will not work to run the script? 


A. Typing bash a_script.sh at the command line. 


B. Typing ./a_script.sh at the command line. 

C. Typing . a_script.sh at the command line. 

D. Typing source a_script.sh at the command line. 
E. Any of the above will work. 


9. Describe the effect of the following short script, cp1.sh, if it's called as 
cpi.sh big.c big.cc: #!/bin/bash cp $2 $1 


A. It has the same effect as the cp command—copying the contents of big.c to 
big.cc. 


B. It compiles the C program big.c and calls the result big.cc. 
C. It copies the contents of big.cc to big.c, eliminating the old big.c. 
D. It converts the C program big.c into a C++ program called big.cc. 
E. It interprets the big.c and big.cc files as bash scripts. 

10. Where are the commands iterated by the loop located within the loop? 
A. Within the then statement section 
B. Between the double semicolons (;;) 
C. Within the case and esac constructs 
D. Within the test statement 
E. Between do and done constructs 


11. Which of the following lines identify valid shell scripts on a normally 
configured system? (Select two.) 


A. #!/bin/script 
B. #!/bin/bash 
C. #!/bin/tcsh 
D. !#/bin/sh 

E. !#/bin/zsh 


12. Which of the following are valid looping statements in bash shell scripting? 
(Select all that apply.) 


A. for 


B. while 
C. if-then 
D. until 
E. case 


13. Your SMTP email server receives a message addressed to postmaster. The 
postmaster username has an alias of john on this computer. Assuming that 
the system is properly configured, who will receive the email message? 


A. postmaster 
B. john 
C. The account listed in ~/. forward 
D. root 
E. No user, because an alias was set 
14. Which of the following is not a popular SMTP server for Linux? 
A. Postfix 
B. Sendmail 
C. Fetchmail 
D. Exim 
E. qmail 
15. You see the following line in a script: 


mail -s "Error" -c abort < tmpmsg root 


What is the effect of this line, if and when it executes? 


A. An email is sent to the user Error, the script is aborted using root 
privileges, and error messages are written to tmpmsg. 


B. An email with the subject of Error and the contents from tmpmsg is sent to 
the local users root and abort. 


C. An email with the subject of Error and the contents of tmpmsg is sent to the 
local user root, and then the script is aborted. 


D. An email is sent with Error priority to the local user root, and the email 
system is then shut down with error messages being stored in tmpmsg. 


E. An email with the subject of Error and contents of tmpmsg is sent to root, 
and information on this is logged with priority abort. 


16. Your Internet connection has gone down for several hours. What command 
can you use to check if there is a long list of jobs in the email queue? 


A. service sendmail status 
B. 1p -d queue ~/Maildir 
C. sendmail -bq 

D. mailq 

E. 1s varspool 


17. You examine your etcaliases file and find that it contains the following 
line: 


root: jody 


What can you conclude from this? 
A. Email addressed to jody on this system will be sent to the local user root. 
B. Email addressed to root on this system will be sent to the local user jody. 


C. The local user jody has broken into the system and has acquired root 
privileges. 


D. The local user jody has permission to read email directly from root's mail 
queue. 


E. The administrator may log in using either username: root or jody. 


18. You've just installed MySQL and run it by typing mysq1. How would you 
create a database called fish to store data on different varieties of fish? 


A. Type NEW DATABASE fish; at the mysql> prompt. 
B. Type CREATE DATABASE fish; at the mysql> prompt. 
C. Type NEW DATABASE FISH; at the mysql> prompt. 
D. Type DATABASE CREATE fish; at the mysql> prompt. 
E. Type DB CREATE fish; at the mysql> prompt. 
19. Which of the following are true statements about SQL tables? (Select two.) 
A. Multiple tables may exist in a single SQL database. 


B. Tables may be combined for cross-table searches using the DROP command. 


C. Tables consist of rows, each of which holds attributes, and columns, each of 
which defines a specific database item. 


D. Careful table design can reduce the amount of data entry and database 
storage size. 


E. Tables are stored on disk using a lossy compression algorithm. 


20. What is the effect of the following SQL command, assuming the various 
names and data exist? 


mysql> UPDATE stars SET magnitude=2.25 WHERE 
starname='Mintaka'; 


A. It returns database entries from the stars table for all stars with magnitude 
of 2.25 and starname of Mintaka. 


B. It sets the value of the stars field in the magnitude set to Mintaka, using a 
precision of 2.25. 


C. It sets the value of the magnitude field to 2.25 for any item in the stars 
table with the starname value of Mintaka. 


D. It combines the stars and magnitude=2.25 tables, returning all items for 
which the starname is Mintaka. 


E. It updates the stars database, creating a new entry with a starname value 
of Mintaka and a magnitude of 2.25. 


Chapter 10 
Securing Your System 


THE FOLLOWING EXAM OBJECTIVES ARE COVERED IN THIS 
CHAPTER: 


Y 1.110.1 Perform security administration tasks 
Y 1.110.2 Set up host security 
Y 1.110.3 Securing data with encryption 


Chances are that you take basic security measures in your daily life, such as 
locking the door to your house or apartment, not advertising an upcoming 
vacation on social media, not setting your smartphone down in a store, and so 
on. Such measures can minimize the risk of theft or even personal injury. Similar 
measures on a computer can help protect the computer from compromise. 


This chapter covers several security issues: restricting access to the computer by 
port number, managing the security of individual programs, managing 
passwords, setting miscellaneous account security options, and using encryption 
to secure data. Understanding these basics will help you begin to secure your 
computer. 


Lh 
OK. 
There is no such thing as a 100 percent secure computer. You can take steps 
to improve security, but there is absolutely no guarantee that you will not 
have security problems. You must decide (or the organization for which you 
work must decide) just how much effort to put into securing your systems, 
and live with the threat level that remains. This chapter's security 
information can help you start securing your computer. If you need more 


security information, you can start your research at websites such as the 
SANS Institute, www.sans.org, and Gibson Research Corporation, 


www.grc.Ccom. 


Administering Network Security 


Linux systems are often used as server computers. On such systems, network 
security is particularly important because incorrectly configured servers can 
provide troublemakers with a way into your computer. There are several 
methods for protecting networked computers from unwanted outside access. 
Some of the simplest methods involve blocking or restricting access to network 
servers via their network ports. (Network ports are described in Chapter 8, 
“Configuring Basic Networking.”) You can check for existing network 
connections, check for open ports (that is, ports that are in use by a server 
program), use super daemon restrictions to limit access, and disable servers that 
you're not using. 
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The popular media uses the term hacker to refer to computer criminals. This 
word has an older meaning. It also refers to individuals who are skilled with 
computers and who have no malicious intent. Many Linux programmers 
consider themselves hackers in this positive sense. Therefore, terms such as 
troublemaker and attacker are used in this chapter to refer to computer 
criminals. 


Using Super Server Restrictions 


Many network server programs directly open network ports and listen for 
connections. Some distributions have network server programs that work 
through an intermediary: a super server or super daemon. This is a program that 
listens for network connections on behalf of another program. When a 
connection is initiated, the super server hands off control of that connection to 
the intended server. 


You can employ security checks in the super daemon to protect the servers it 
manages. Linux has two primary super daemons: 


inetd 
xinetd 


In the following pages, configuring super server basics are described with 
particular emphasis on their security features. In the case of inetd, security is 
handled by a package called TCP wrappers. By contrast, xinetd's security 
features are built into xinetd itself. 
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Whenever possible, apply redundant access controls. For instance, use both a 
server's own security features and the super daemon's security features to 
block unwanted access. This helps protect against bugs and incorrect 
configurations. For example, if a problem emerges in the super server 
configuration, the secondary block will probably halt the attacker. If you 
configure the system correctly, such an attack will also leave a log file 
message to alert you that the super server didn't do its job. 


Configuring inetd 


The inetd package is a legacy super daemon in Linux. Most likely you will 
never run into it. However, it is listed in the certification exam objectives. 
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The inetd package is deprecated, and it is typically no longer installed on 
Linux distributions. However, because it is a legacy super server that 
deserves some review, it is still covered in the certification exam objectives. 


Setting Up inetd 


Services that launched via inetd were controlled through the etcinetd.conf 
file or files in etcinetd.d/. The etcinetd.conf file consisted of a series of 
lines, one for each server. A typical line was similar to the following: 


ftp stream tcp nowait root usrsbin/tcpd usrsbin/in.ftpd -1l 


Instead of using a single monolithic etcinetd.conf file, later versions of inetd 
enabled you to split the configuration into several files in the etcinetd.d/ 
directory. Doing so allowed easier addition or deletion of server configurations 
by adding or deleting their configuration files. For brevity, the following 
paragraphs refer only to etcinetd.conf, but the description applies to files that 
were in etcinetd.d/ as well. 


Each line in etcinetd.conf consisted of several fields separated by one or more 
spaces. The meanings of these fields were as follows: 


Service Name 


The first field (ftp in the preceding example) was the name of the service 
as it appeared in the etcservices file. 


Socket Type 


The socket type entry told the system what type of connection to expect—a 
reliable two-way connection (stream), a less reliable connection with less 
overhead (dgram), a low-level connection to the network (raw), or various 
others. 


Protocol 


This was the TCP/IP Transport layer protocol used, usually tcp or udp. 


Wait/No Wait 


For dgram socket types, this entry specified whether the server connected to 
its client and freed the socket (nowait) or processed all of its packets and 
then timed out (wait). Servers that used other socket types would specify 
nowait in this field. 


User 


This was the username used to run the server. The root and nobody users 
were common choices, but others were possible as well. As a general rule, 
servers were run with a low-privilege user whenever possible as a security 
precaution. Some servers required root access, though. 


Server Name 


This was the server's filename. In the preceding example, the server is 
specified as usrsbin/tcpd, which is the TCP wrappers binary. As 
described shortly in “Controlling Access via TCP wrappers,” this program 
was an important security tool and was usually included as the means of 
launching programs via inetd. 


Parameters 


Everything after the server name consisted of parameters that were passed 
to the server. If you used TCP wrappers, you would pass the name of the 
true target server (such as usrsbin/in.ftpd) in this field, along with its 
parameters. 


The hash mark (#) was a comment symbol for etcinetd.conf. Therefore, if a 
server was running via inetd and you wanted to disable it, you would place a 
hash mark at the start of the line. If you wanted to add a server to inetd.conf, 
you needed to create an entry for it. 


After modifying inetd.conf, you had to restart the inetd super daemon. It was 
generally restarted using a SysV startup script as described in Chapter 5, 
“Booting Linux and Editing Files.” On most computers, typing something 
similar to the following would have worked: 


# etcinit.d/inetd restart 


Controlling Access via TCP Wrappers 


The TCP wrappers package provides a library known as libwrap. Older TCP 
wrappers packages used with inetd provided a program known as tcpd. The 


inetd did not call a server directly; instead, inetd called tcpd, which did two 
things: It checked whether a client was authorized to access the server, and if the 
client had this authorization, tcpd called the server program. 
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Even though inetd has gone the way of the dinosaurs, TCP wrappers is still 
available for use on Linux systems. For example, the FTP server, vsftpd, 
uses TCP wrappers. If a network service uses TCP wrappers, then it uses the 
libwrap library. You can determine if a network service uses TCP wrappers 
or not by typing Idd NetworkServiceDaemon | grep libwrap at the 
command line. If you get output, then the network service uses TCP 
wrappers. 


TCP wrappers is configured through two files: etchosts.allow and 
etchosts.deny. The first of these specifies computers that are allowed access to 
the service. Systems not listed in hosts.allow are not permitted access. By 
contrast, hosts.deny lists computers that are not allowed access; all other 
systems are granted access to the service. If a computer is listed in both files, 
hosts.allow takes precedence. 


Both files use the same basic format. The files consist of lines in the following 
form: 


daemon-list : client-list 


The daemon-list variable is a list of servers using the names for the servers that 
appear in etcservices. Wildcards are also available, such as ALL for all servers. 


The client -list variable is a list of computers to be granted or denied access to 
the specified daemons. You can specify computers by name or by IP address. 
Also, you can specify a network by using a leading or trailing dot (.) when 
identifying networks by name or IP address block, respectively. For instance, 
.ivytech.edu refers to all computers in the ivytech. edu domain, and 
192.168.7. refers to all computers in the 192.168.7.0/24 network. You can also 
use various wildcard options in the client -list variable, such as ALL (all 
computers). 


The EXCEPT operator creates an exception. For example, the following client- 
list setting is placed in the hosts . deny file: 


[..]: 192.168.7. EXCEPT 192.168.7.105 


The preceding client-list setting would block all computers in the 
192.168.7.0/24 network. However, an exception would be made for 
192.168.7.105. 


The man pages for hosts.allow and hosts. deny (they're actually the same 
document) provide additional information about more advanced features. You 
should consult them if you build TCP wrappers rules. 


Configuring xinetd 


The xinetd program is an extended super daemon. It provides the functionality 
of the legacy inetd, plus security options that are similar to those of TCP 
wrappers. 


Setting Up xinetd 


The etcxinetd.conf file controls the xinetd super daemon. On distributions 
that use xinetd, this configuration file contains only global default options. At 
the file's bottom is a directive to include files stored in the etcxinetd.d/ 
directory: 


includedir etcxinetd.d 


Each server that should run via xinetd installs a file in etcxinetd.d/ with its 
own configuration options. Those file options are then included in the main 
xinetd configuration file. 
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If you cannot find the etcxinetd.conf file on your system, most likely the 
xinetd package is not installed. See Chapter 2, “Managing Software,” for 
information on how to install this package on your system if desired. 


Whether the server entry goes in etcxinetd.conf or ina file in etcxinetd.d/, 
the configuration information is similar to that in the inetd.conf file. However, 
the xinetd configuration information is spread across multiple lines and labeled 
more explicitly. The following shows an xinetd configuration example: 


$ cat etcxinetd.d/rsync 
# default: off 


[...] 

service rsync 

{ 
disable = yes 
flags = IPv6 
socket_type = stream 
wait = no 
user = root 
server = usrbin/rsync 
server_args = --daemon 
log_on_failure += USERID 

} 

$ 


One xinetd configuration parameter that is commonly present is disable. If you 
include the line disable = yes in a service definition, xinetd ignores this 
server. Some server packages install startup files in etcxinetd.d/ and have this 
option set by default. You must edit the file and change the entry to read 
disable = no to enable the server. You can also temporarily disable a set of 
servers by listing their names in the defaults section of the main xinetd.conf 
file on a line called disabled. 
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It's generally wise to make sure that as many servers as possible are disabled 
in the xinetd configuration files. As a general rule, if you don't understand 
what a server does, leave it disabled. This will improve the security of your 
system by eliminating potentially buggy or incorrectly configured servers. 


After you make changes to xinetd's configuration, you must either reload the 
configuration file or restart the super server. For example, on a system using 
SysV startup scripts, you do this by running the appropriate script located in 
either etcinit.d/ or etcrc.d/init.d/ and passing either the reload or 
restart parameter: 


# etcinit.d/xinetd restart 


Controlling Access via xinetd 


Security is handled on a server-by-server basis through the use of configuration 
parameters in either etcxinetd.conf or the server-specific configuration files. 
Some of these options are similar to the function of hosts.allow and 
hosts.deny: 


Network Interface 


The bind option tells xinetd to listen on only one network interface for the 
service. For instance, you can specify bind = 192.168.23.7 on a router to 
have it listen only on the Ethernet card associated with that address. This 
feature is extremely useful in routers, but it isn't as useful in computers with 
just one network interface. You can, however, use this option to bind a 
server only to the loopback interface, 127.0.0.1, if a server should be 
available only locally. You might do this with a configuration tool like the 
Samba Web Administration Tool (SWAT). A synonym for this option is 
interface. 


Allowed IP or Network Addresses 


You can use the only_from option to specify IP addresses, networks (as in 
192.168.78.0/24), or computer names on this line, separated by spaces. 


The result is that xinetd will accept connections only from these addresses, 
similar to TCP wrappers’ hosts.allow entries. 


Disallowed IP or Network Addresses 


The no_access option is the opposite of only_from; you list computers or 
networks here that you want to blacklist. This is similar to the hosts. deny 
file of TCP wrappers. 


Access Times 


The access_times option sets times during which users may access the 
server. The time range is specified in the form hour :min-hour:min, using a 
24-hour clock. Note that this option affects only the times during which the 
server will respond. If the xinetd access_times option is set to 8:00- 
17:00 and somebody logs in at 4:59 p.m. (one minute before the end time), 
that user may continue using the system well beyond the 5:00 p.m. cutoff 
time. 


You should enter these options into the configuration files in etcxinetd.d/ that 
correspond to the servers you want to protect. Place the lines between the 
opening brace ({) and closing brace (}) for the service. If you want to restrict all 
of your xinetd-controlled servers, you can place the entries in the defaults 
section in etcxinetd.conf. 
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Some servers provide access control mechanisms similar to those of TCP 
wrappers or xinetd. For instance, Samba provides hosts allow and hosts 
deny options that work much like the TCP wrappers file entries. These 
options are most common on servers that are awkward or impossible to run 
via xinetd. 


Configuring a Firewall 


Although the exam objectives don't mention firewalls, you should be 
familiar with the concept. A firewall is a filter that restricts access to and/or 
from computers or services. Broadly speaking, two types of firewalls exist: 
packet-filter firewalls, which work by blocking or permitting access based 
on low-level information in individual data packets (such as source and 
destination IP addresses and ports), and proxy filters, which partially process 
a transaction (such as a web page retrieval) and block or permit access based 
on high-level features in this transaction (such as the filename of an image in 
the web page). 


In Linux, the kernel includes packet-filter firewall capabilities, which can be 
programmed via the iptables program. You can set up rules by typing 
iptables followed by various options that define specific restrictions, such as 
limits on the IP addresses that may access a specific network port. Creating 
an effective firewall requires learning iptables in detail and writing a script 
that calls this program repeatedly to set up specific rules. The nftables 
program is slated to replace the iptables program. See 
netfilter.org/projects/nftables for the current status of this program. 


Many distributions make things easier by providing a generic firewall script 
that you can configure using a GUI tool or text-based command. For 
example, Ubuntu offers the Uncomplicated Firewall utility, ufx, to help set 
up iptables rules. These tools are generally designed for protecting a single 
computer against unwanted outside access. Check your distribution's GUI 
system administration options and man pages for a firewall configuration 
tool. You may be able to set security based on a few levels (high, medium, 
and low security, for instance) or in a somewhat more refined manner. 


Linux can also function as a firewall computer that protects an entire 
network; however, such a configuration is likely to require in-depth 
knowledge of iptables, as well as topics which include configuring Linux 
as a router. 





Disabling Unused Servers 


Quite a few server programs ship with most Linux distributions. This can be a 
great advantage because you don't need to install additional software to get a 
server package up and running. On the other hand, this very advantage can be a 
drawback. If you're not careful, you can end up running a network service and 
not even realize it's installed! 


For security reasons, you should periodically audit your servers' network 
services and disable any service that you find isn't necessary. For example, if 
your Linux system functions only as a print server, it should not be running the 
Apache web server daemon, httpd. Limiting the network service programs 
running on a system equates to fewer attack points for a troublemaker. 


Several audit tools exist, such as netstat, lsof, and remote network scanners. 
You can also search your local configuration files for clues about what may be 
running. Unused servers can be disabled by uninstalling the package or by 
reconfiguring the server. 


Using netstat 


One way to begin auditing network security is to look for network activity or 
open ports on a computer. One older tool that can help in this respect is netstat. 
This useful program provides many different options and output formats to 
deliver information about routing tables, interface statistics, and so on. 
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The netstat program is considered obsolete, though you may still find it on 
some Linux distributions. It is also listed in the certification exam's 
objectives and therefore needs to be covered here. However, the current 
utility to use for network auditing and displaying network information is the 
ip program. See the man pages for more information on the ip utility. 


For spotting unnecessary servers, you can use netstat with its -a and -p 
options. The -a option shows all network sockets. The -p option shows the PID 
and program name that owns a shown socket. 


The output displayed by netstat is so wide that it has to be split into two 
separate snipped displays for the book, as shown here. This first netstat output 
display shows the three left-hand columns of information: 


# netstat -ap 
Active Internet connections (servers and established) 


Proto Recv-Q Send-Q [...] 
tcp 0 o [...] 
tcp 0 o [...] 
tcp 0 o [...] 
tcp 0 o [...] 
tcp 0 o [...] 
tcp 0 0 [...] 
tcp 0 0 [...] 
tcp 0 o [...] 
[... ] 

# 


This second netstat output display shows the four right-hand columns of 
information: 


# netstat -ap 
Active Internet connections (servers and established) 


[..]Local Address Foreign Address State PID/Program 
name 

[..]*:sunrpc : LISTEN 1096/rpcbind 
[...]*:ssh : LISTEN 1401/sshd 


[..]0 localhost:ipp i LISTEN 1276/cupsd 


[...]* 140952 ; LISTEN 
1239/rpc.statd 


[..]localhost :smtp : LISTEN 1503/master 
[..]0 192.168.56.101:ssh 192. 168.56.1:49159 ESTABLISHED 2421/sshd 
[...]0 *:Ssunrpc : LISTEN 1096/rpcbind 
[..]*:ssh i LISTEN 1401/sshd 
[... ] 

# 


There is so much information when you issue this command on your system(s) 
that it would be wise to pipe it into the less command like so: netstat -ap | 
less. Also, you may need to adjust your screen's resolution to prevent columns 
from wrapping in the netstat output to your screen. 
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The netstat command can be run as an ordinary user, but it may not return 
as much information. Specifically, only root and a process's owner see the 
PID/Program name column information. 


The netstat command with the -ap options shows active network sockets that 
can reveal the presence of servers that are running on your computer. The Local 
Address and Foreign Address columns specify the local and remote addresses, 
including both the hostname or IP address and the port number or associated 
name from etcservices. Entries that are not actively connected will show the 
local address and the foreign address as asterisks (*). 


The State column specifies that the server is listening (LISTEN) for a connection 
or that a connection is currently active (ESTABLISHED). There are several 
additional states as well, besides the two shown in the preceding example. Type 
man netstat to learn about more potential State statuses. 


The final column in this output, under the PID/Program name heading, indicates 
the process ID (PID) and program name of the service using this port. Notice 
that several services are currently listening for connection requests. However, 
there is only one established connection whose PID is 2421, and its program is 
the Secure Shell daemon (sshd). 


It may take some time to peruse the output of netstat, but doing so will leave 
you with a much-improved understanding of your computer's network 
connections. If you spot servers listening for connections that you didn't realize 
were active, you should investigate the matter further. Some servers may be 
innocent or even necessary. Others may be pointless security risks. 
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To spot servers listening for connections quickly, type netstat -1p rather 
than netstat -ap. The result will show all servers that are listening for 
connections, omitting client connections and specific server instances that 
are already connected to clients. 


Exercise 10.1 demonstrates the use of netstat to monitor network port use. 


Exercise 10.1 


Monitor Network Port Use 





To get started with netstat, follow these steps: 


1. 


Log into the Linux system as a normal user. (Acquiring root privileges 
will produce more complete output, as described earlier, but it isn't 
strictly necessary for this exercise.) 


. Launch a terminal from the desktop environment's menu system if you 


used a GUI login method. 


. Type netstat -ap | less, and page through the output. Chances are 


you'll see quite a few entries for servers, which are listening for new 
connections and for established connections to local servers or from 
local clients to remote servers. Pay particular attention to servers that 
are listening for new connections. You can identify those servers by the 
keyword LISTEN displayed in the State column of the output. 


. Type netstat -ap | grep ssh to find connections involving SSH. 


Depending on your configuration and the servers you have running, you 
may see no output or many lines of output. 


5. Determine your system's IP address by typing the ifconfig command. 


6. In another terminal login session, initiate an SSH connection to your 


computer. (The Secure Shell is discussed later in the section 
“Configuring SSH.”) For instance, type ssh 192.168.78.5 if the IP 
address you obtained in step 5 is 192.168.78.5. 


7. Type netstat -ap | grep ssh in your original session (not in your 
SSH connection). Compare the output to that which you obtained in 
step 4. The output should have an additional line reflecting the session 
you initiated in step 6. 


8. Log out of the SSH session you initiated. 


9. Type netstat -ap | grep ssh again. The output should be missing the 
line for the session you've now closed. 


If you're using a multiuser system, additional SSH sessions may come and 
go during the course of this exercise, reflecting the activities of other users. 





Using /sof 


The lsof program nominally lists open files. It can be used to identify what files 
are open in a directory, find who's accessing them, and so on. The definition of a 
file used by 1sof is broad because it includes network connections. Thus, you 
can use lsof to audit your network ports. With the -i parameter, the lsof 
command will show you not only various services listening for connections, but 
also any current network connections to those services. Here is an example: 


# lsof -i 

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME 
rpcbind 1096 rpc 6u IPv4 11127 OtO UDP :sunrpc 
lead 

cupsd 1276 root 9u IPV4 11828 oto UDP :ipp 
sshd 1401 root 3u IPv4 12397 OtO TCP :ssh 
(LISTEN) 

sshd 1401 root 4u IPv6 12401 OtO TCP :ssh 
(LISTEN) 

[... ] 

sshd 3014 root 3r IPv4 23963 Oto TCPu 
192.168 .56.101:ssh->192.168.56.1:49165 (ESTABLISHED) 

dhclient 3016 root 7u IPv4 24029 OtO UDP *:bootpc 
# 


As in the output of netstat shown earlier, this output is snipped for brevity's 
sake. Notice that there are three lines that begin with sshd. The first two sshd 
lines show servers that are listening for connections on the ssh ports. These lines 
are identified by the fact that the NAME column takes the form *: service 
(LISTEN), where service is the service name or port number. Other columns in 
the output reveal additional information, such as the PID and username 


associated with the port access. 


The third line beginning with sshd shows an outgoing connection from 
192.168.56.101 (the system on which the lsof -i command was typed) to the 
ssh port on 192.168.56.101. Such connections are identified by the existence of 
two IP addresses (or hostnames) in the NAME column and by the keyword 
ESTABLISHED in the same column. 
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If you type lsof -i as an ordinary user, you'll see only your own network 
connections. Thus, in order for this command to be a useful diagnostic for 
system security, you must run it using superuser privileges or as root. 


You can restrict the output of 1sof by including an address after the -i option. 
The address takes the following form: 


[46] [protocol][@hostname|hostaddr][:service|port] 


The lsof -i address syntax is as follows: 
The digit 4 or 6 that represents an IPv4 or IPv6 connection 
protocol, which is a protocol type (TCP or UDP) 


hostname or hostaddr, which is the computer hostname or IP address 
associated with a remote system 


service, which is a service name (from etcservices) 
port, which is a port number 


For instance, suppose you want to verify that no FTP server is running on a 
computer. You can search for any connections associated with the FTP port: 


# lsof -i :ftp 


Alternatively, you can replace ftp with 21, because 21 is the port number 
associated with the FTP port. (See Chapter 8 for common network port 
numbers.) In either case, this command returns a list of all processes associated 
with FTP connections, both incoming and outgoing. If no such connections exist, 
the command returns no output. Be sure to note which output lines are linked 
with the server, as opposed to client processes. Even if you're not running an 
FTP server locally, the preceding command may produce dozens of lines of 
output if users on the computer are accessing remote FTP clients. 
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Another use of 1sof is in identifying who is accessing files. This might be 
handy if you need to unmount a filesystem (including a network filesystem) 
but can't because of in-use files. This command is also useful if you suspect 
inappropriate activities involving file access. 


To perform a general audit of the network services your system is offering, you 
can pipe the output into the less command. This will allow you to review the 
network services methodically and determine if there is any need to disable 
them. 


Using Remote Network Scanners 


Network scanners, such as Nmap, can scan for open ports on the local computer 
or on other computers. Nmap is a very easy to use utility for conducting security 
audits on your systems. 


ghi 
OK. 
Besides being used by network administrators for legitimate purposes, 
network scanners are often used by troublemakers to locate systems to 
attack. Many organizations have policies forbidding the use of network 
scanners except under specific conditions. Therefore, you should check these 
policies and obtain explicit permission to perform a network scan. Failure to 


do so could cost you your job or even result in criminal charges, even if your 
intentions are honorable. 


Nmap is capable of performing basic checks for open ports. To conduct this 
simple audit using the nmap utility, add the -sT parameters. Your first scan 
should be done using the loopback address (127.0.0.1). This allows you to see 
what network services are being offered by your system without any firewall 
settings interfering with the results: 


$ nmap -sT 127.0.0.1 

Starting Nmap 5.51 ( http://nmap.org ) at 2015-03-07 13:16 EST 
Nmap scan report for localhost (127.0.0.1) 

Host is up (0.0011s latency). 

Not shown: 996 closed ports 

PORT STATE SERVICE 

22/tcp open ssh 

25/tcp open smtp 

111/tcp open rpcbind 

631/tcp open ipp 

Nmap done: 1 IP address (1 host up) scanned in 0.24 seconds 
$ 


In the preceding example's Nmap results, you can see that four network services 
(ssh, smtp, rpcbind, and ipp) are currently listening for services requests at 
designated ports (22, 25, 111, 631). However, to see what services can be 
reached outside the firewall, you need to conduct another scan. 


Poa 


Most Linux distributions do not come with the nmap utility installed by 
default. See Chapter 2, “Managing Software,” to learn how to install 
software packages, such as nmap. 


This scan is almost exactly like the preceding example. It uses the same nmap 
options, -sT. However, this time, the machine's IP address is used instead of the 
loopback address. This will allow you to see what services are not being blocked 
by a firewall: 


$ nmap -sT 192.168.56.101 

Starting Nmap 5.51 ( http://nmap.org ) at 2015-03-07 13:20 EST 
Nmap scan report for 192.168.56.101 

Host is up (0.00049s latency). 

Not shown: 998 closed ports 

PORT STATE SERVICE 

22/tcp open ssh 

111/tcp open rpcbind 

Nmap done: 1 IP address (1 host up) scanned in 13.18 seconds 

$ 


Notice that this time, only two services are displayed. Keep in mind that even 
though the outside world may not see all of the services, you still should disable 
unneeded network services. 


The -sT option allows you to scan for services using TCP. Some network 
services use UDP. To scan for these with nmap, use the -su option as shown 
here: 


$ sudo nmap -sU 127.0.0.1 

[sudo] password for Christine: 

Starting Nmap 5.51 ( http://nmap.org ) at 2015-03-07 13:27 EST 
Nmap scan report for localhost (127.0.0.1) 

Host is up (0.000022s latency). 

Not shown: 997 closed ports 


PORT STATE SERVICE 
68/udp open|filtered dhcpc 
111/udp open rpcbind 


631/udp open|filtered ipp 


Nmap done: 1 IP address (1 host up) scanned in 1.29 seconds 
$ 


Notice that superuser privileges are required to run a UDP scan, whereas they 
were not required for running a TCP scan. In the previous example, there are 
three network services being offered: dhcpc listening at port 68, rpcbind 
listening at port 111, and ipp listening at port 631. 


Nmap is capable of more sophisticated scans, including “stealth” scans that 
aren't likely to be noticed by most types of firewalls, ping scans to detect which 
hosts are active, and more. The Nmap man page provides details. You can also 
find out more about Nmap at www.nessus.org. 


Another scanning tool called Nessus, which is built atop Nmap, provides a 
graphical user interface. It also offers a means of performing automated and 
sophisticated tests. Nessus is a more sophisticated scanner in that it checks for 
known vulnerabilities. 


Nessus comes as separate client and server components; the client enables you to 
control the server, which does the actual work. You can find out more about 


Nessus at www.nessus.org. 
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You can use a stand-alone Linux boot CD-ROM to perform security checks 
on a network. Special Linux distributions intended for this purpose, such as 
Kali Linux (http://www.kali.org), provide easy access to Nmap and other 
network security tools. These special distributions enable quick checks of a 
network's security even if no computer on that network regularly runs Linux. 


Using fuser 


Another handy network port auditing tool is the fuser command. You can use 
this tool to determine the processes currently using a particular network port. For 
example, to see what process is currently using network port 22, use fuser and 
pass the port number and network protocol in the following manner: 


$ sudo fuser 22/tcp 
[sudo] password for Christine: 


22/tcp: 1415 1881 1885 
$ 
$ ps 1415 

PID TTY STAT TIME COMMAND 

1415 ? Ss 0:00 usrsbin/sshd 
$ 
$ ps 1881 

PID TTY STAT TIME COMMAND 

1881 ? Ss 0:00 sshd: Christine [priv] 
$ 
$ ps 1885 

PID TTY STAT TIME COMMAND 

1885 ? S 0:00 sshd: Christine@pts/0 
$ 


In the preceding display, the fuser command produces three process IDs (PIDs). 
Each of these processes is using port 22 with TCP. Using the ps command, you 
can investigate each process further. However, there is an easier way. Simply 
add the -v option on the fuser command to see all of the processes’ information 
in one straightforward command: 


$ sudo fuser -v 22/tcp 


USER PID ACCESS COMMAND 
22/tcp: root 1415 F... sshd 
root 1881 f... sshd 
Christine 1885 F... sshd 
$ 


This method provides a quick analysis of who is using port 22. Notice that each 
time you use fuser, superuser privileges are required. 


The access column in the preceding display indicates whether or not the process 
has a file open (f) or a file open for writing (F). The fuser utility is similar to the 
1sof utility in that it can also view processes accessing files. 
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Notice that the fuser command uses the syntax of Port/Protoco1 to denote 
which port and protocol to inspect. This option matches the output of the 
syntax used by Nmap's scan output. Therefore, in security scripts, you could 
use various filter commands (see Chapter 1, “Exploring Linux Command- 
Line Tools”) to pull information from nmap output and feed it into fuser 
commands to produce audit or security incident reports. 


There is also another format of the fuser command to view network processes 
using a particular port. In the following example, the -n option is used. Notice 
that the -v option is still included; however, the formatting of the port number 
and network protocol have changed: 


$ sudo fuser -nv tcp 22 
[sudo] password for Christine: 


USER PID ACCESS COMMAND 
22/tcp: root 1415 F... sshd 
root 1881 f... sshd 


Christine 1885 F... sshd 
$ 


This displays the exact same output as previously. Since they both display the 
same thing, use the syntax that is easier for you to remember. 


To obtain information for other ports and protocols, just modify the options 
passed to the fuser command. For example, to check what processes are 
accessing port 631 using the UDP protocol, issue the following fuser command: 


$ sudo fuser -nv udp 631 

USER PID ACCESS COMMAND 
631/udp: root 1276 F... Cupsd 
$ 


Each of the various auditing tools covered so far provide different types of 
information that can be useful for different security tasks. One task, however, 
doesn't come with a helpful auditing tool. You must sit down and review server 
configuration files, as covered in the next section. 


Examining Configuration Files 


Most Linux server packages include configuration files. Thus, you may be able 
to spot installed but unwanted servers by looking for their configuration files. 


Startup scripts are described in Chapter 5, “Booting Linux and Editing Files,” so 
review that chapter for details of how they're managed. If you find such a script 
for a server that you know you don't want to run, you should disable it as 
described in Chapter 5. Keep in mind that server startup scripts and management 
tools are different depending upon whether your distribution uses SysV, Upstart, 
or systemd for managing system services. 


Be aware that many startup scripts start entire subsystems that aren't directly 
network-related. Thus, you'll probably see startup scripts that you don't 
recognize. You should not automatically disable these scripts because they may 
be necessary even if you don't recognize the name. If in doubt, leave them in 
place until you can research the matter further. 
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Try doing a Web search on the name of the startup script, possibly in 
conjunction with “Linux” or “startup script.” Chances are that you'll find a 
helpful reference. 


If your system uses xinetd, you should examine your xinetd configuration files 
for unwanted servers. Unlike system startup scripts, super servers launch 
network servers only, not non-network services. Therefore, you should take a 
more aggressive approach to disabling entries that you don't recognize from your 
super server configuration than you do with system startup scripts. 


On older distributions using the SysV startup system, etcinittab deserves 
examination. This file is used to control some of the earliest stages of the startup 
process. Older etcinittab installations would start processes that accepted text- 
mode logins. They also started additional similar processes used to accept logins 
via dial-up modems and RS-232 serial ports. This can be an issue from a security 
viewpoint. While it's unlikely, you may be surprised to find a long-forgotten old 
dial-up modem still connected to a computer server. You want to check to ensure 
that an older system isn't listening for dial-up modem connections! Files called 
etcinit/tty# (where # is a number) control local login access, whereas 
etcinit/ttyS# files control RS-232 serial or modem access. 


Modern systems lack etcinittab or have only very basic etcinittab files. 
Typically, the original etcinittab functions have been moved into other files, 
such as startup scripts or files in etcinit. You won't ordinarily need to modify 
such configurations. 


Uninstalling or Reconfiguring Servers 


Once you've identified an unnecessary server, your task becomes one of shutting 
it down. Broadly speaking, two options exist. 


First, you can disable the server by changing its startup script configuration or, if 
it uses the system's super daemon, disabling it in the daemon's configuration 
files. Consult Chapter 5 for details on how to change a server's startup script 
and/or the preceding sections on xinetd for details on how to disable xinetd via 


its configuration files. Disabling the server in this way has the advantage that 
you can easily reactivate it in the future if you decide to do so. It has the 
disadvantage that the server's files will continue to consume disk space, and the 
server might be accidentally reactivated in the future. 


Second, you can completely uninstall the server using your distribution's 
package management tools or by otherwise deleting its files. Chapter 2, 
“Managing Software,” describes this task. Completely uninstalling software has 
the advantage of reducing the risk of accidental reactivation. However, it has the 
drawback that it will take more effort to reactivate the server should you decide 
to do so in the future. 


Overall, completely removing the server is generally preferable unless you 
merely want to disable a server temporarily. If you decide to reactivate the server 
in the future, you can always reinstall it. 


Administering Local Security 


Security isn't limited to networking—local security issues can be as much of a 
threat as remote intruders. Thus, you should attend to some local security 
matters: securing passwords, limiting root access to the computer, auditing user 
access, setting user limits, and tracking down SUID/SGID files. 


Securing Passwords 


A default Linux configuration relies heavily on passwords. Users' passwords are 
their keys into the system. Careless password handling is much like the careless 
handling of physical keys. In either case, security breaches can result. 
Understanding these risks is critical to maintaining system security, but this is 
one task for which you must enlist the help of your users. You should also be 
aware of some of the tools that Linux provides to help keep passwords secure. 
(Most of the details concerning password-related commands are described in 
Chapter 7, “Administering the System.”) 


Looking at Password Risks 


Passwords can end up in attackers’ hands in various ways, and you must take 
steps to minimize the risk. You can take the following steps to improve your 
system's security: 


Use Strong Passwords 
Users should employ good passwords, as described shortly in “Choosing a 


Good Password.” Educate your system's users on how to build strong 
passwords and use policies and tools to enforce them. 


Change Passwords Frequently 


You can minimize the chance of damage due to a compromised password 
by changing passwords frequently. Some Linux tools can help to enforce 
such changes, as described briefly in the section “Using Tools for Password 
Management,” and in more detail in Chapter 7. 


Use Shadow Passwords 


If an attacker has gained access to your system or a regular user is a 
troublemaker, be aware that either of them can read data stored in the 
password file etcpasswd. This is because the etcpasswd file is world- 


readable. If for some reason your Linux distribution stores its passwords in 
there, your system is vulnerable! Even though passwords are hashed, there 
are several hashed password—cracking programs available. For this reason, 
you should store passwords in etcshadow. This file is only readable by the 
superuser. 


All major Linux distributions use shadow passwords by default. If yours 
doesn't, you can type pwconv to move all password information from the 
etcpasswd file to the locked-down etcshadow file. It's a good idea to run 
the pwck utility after the conversion to ensure that the files are in sync. 


Keep Passwords Secret 


You should remind your users not to reveal their passwords to others. Such 
trust is sometimes misplaced, and sometimes even a well-intentioned 
password recipient may slip up and let the password fall into the wrong 
hands. This can happen by writing the password down, storing it in 
electronic form, or sending it by email or other electronic means. Users 
shouldn't email their own passwords to themselves because email can be 
intercepted. 


Use Secure Remote Login Protocols 


Certain remote login protocols are inherently insecure because they allow 
data to traverse the network in an unencrypted form. Intervening computers 
can be configured to snatch passwords from such sessions. Because of this, 
it's best to disable Telnet, FTP, and other protocols that use cleartext 
passwords in favor of protocols that encrypt passwords, such as SSH and 
SFTP. 


Be Alert to Shoulder Surfing 


If your users log in using public terminals, as is common on college 
campuses and other open areas, it's possible that others will be able to 
watch them type their passwords, a practice sometimes called shoulder 
surfing. Users should be alert to this possibility and minimize such logins if 
possible. 


Use Each Password on Just One System 


If one computer's password database is compromised and if users of that 
system reuse their passwords on other systems, those other systems can also 
be compromised. For this reason, it's best to use each password just once. 


Unfortunatelv. the proliferation of websites that require passwords for 


access makes this rule almost impossible to enforce, at least without 
violating the rule of not writing the password down. (Web browsers can 
remember passwords for you, by storing them in a file—essentially, 
writing them down.) A reasonable compromise might be to use one 
password for the least-sensitive websites (such as online newspapers) and 
unique passwords for sensitive websites (such as banking sites) and login 
accounts. 


Be Alert to Social Engineering 


Attackers often use social engineering to obtain passwords. This practice 
involves tricking individuals into giving up their passwords by pretending 
to be a system administrator or by otherwise misleading victims. 
Amazingly, a large percentage of people fall for this ploy. 


A related practice is phishing, in which an attacker puts up a fake website 
or sends an email that seems to be from somebody else. The victim is then 
lured into revealing sensitive data (such as credit card numbers). 


Some of these steps are things you can do, such as replacing insecure remote 
login protocols with encrypted ones. Others are things your users must do. This 
illustrates the importance of user education, particularly on systems with many 
users. 


Choosing a Good Password 


As a general rule, users tend to pick passwords that are too easy to guess, and 
they change those passwords infrequently. Fortunately, Linux includes tools to 
help make your users select good passwords and change them regularly. 


Poor but common passwords include those based on the following: 


Any simple keyboard or alphanumeric combination, such as abcd or 123456 
The word password 

The names of family members, friends, and pets 

Favorite books, movies, television shows, or the characters in any of these 
Telephone numbers, street addresses, or Social Security numbers 

Any other meaningful personal information 


Any single word that's found in a dictionary (in any language) 


The best possible passwords are random collections of letters, digits, and 


punctuation. Unfortunately, such passwords are difficult to remember. A 
reasonable compromise is to build a password in two steps: 


1. Choose a base that's easy to remember but difficult to guess. 


2. Modify that base in ways that increase the difficulty of guessing the 
password. 


One approach to building a base is to use two unrelated words, such as bun and 
pen. You can then merge these two words (bunpen). Another approach, and one 
that's arguably better than the first, is to use the first letters of a phrase that's 
meaningful to the user. For instance, the first letters of “yesterday I went to the 
dentist” become yiwt td. In both cases, the base should not be a word in any 
language. 


As a general rule, the longer the password, the better. Older versions of Linux 
could handle passwords of no more than eight characters, but those limits have 
been lifted by the use of the MD5 and SHA password hashes, which are the 
standard on modern Linux distributions. Many Linux systems require passwords 
to be at least four to six characters in length; the passwd utility won't accept 
anything shorter than the distribution's minimum. 


With the base in hand, it's time to modify it to create a password. The user 
should apply at least a couple of several possible modifications: 


Adding Numbers or Punctuation 


One important modification is to insert random numbers or punctuation in 
the base. This step might yield, for instance, bu3npe&n or y#i9wttd. Asa 
general rule, add at least two symbols or numbers. 


Mixing Case 


Linux uses case-sensitive passwords, so jumbling the case of letters can 
improve security. Applying this rule might produce Bu3nPE&n and 
y#i9wt tD, for instance. 


Growing the Haystack 


A would-be intruder's task of discovering a password has been likened to 
finding a needle in a haystack. One way to make this task harder is to 
increase the size of the haystack. In password terms, this means making a 
password longer. You can do this by using longer words or phrases, of 
course, but this can make a password harder to remember and type. Even a 
size increase that simply repeats a single character can be helpful. Thus, 


Your best tool for getting users to pick good passwords is to educate them. Tell 
them that malicious individuals who know them or even who target them can 
guess their passwords. Inform users that their personal information can be 
looked up on social media, on company websites, on online professional 
networking sites, and so on. Educating your users on proper password creation 
and management will help them understand the potential threats and help to 
motivate at least some of them to pick good passwords. 
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Password cracking tools are not just available to attackers and 
troublemakers. You can use them as well. Use password cracking tools 
against passwords in your system's etcshadow file. Work with your 
company's management first to determine how to handle users who 
habitually pick easily cracked passwords properly. 


Another password security issue is password changes. Frequently changing 
passwords minimizes the window of opportunity for troublemakers to do 
damage. If an attacker obtains a password but it changes before that password is 
used, disaster is averted. 
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Some system administrators set up a honeypot account. A honeypot account 
is a system account with a fairly easy-to-crack password. The account is 
locked down from accessing anything on the system, and it's also monitored. 
If a login occurs, you know that the etcshadow file has been compromised 
and you can take appropriate actions, such as having all of your users change 
their passwords. 


As described shortly, you can configure accounts to require periodic password 
changes. When so configured, an account will stop accepting logins after a time 
if the password isn't changed periodically. You can configure the system to warn 
users when this time is approaching. This is a very good option to enable on 
sensitive systems or those with many users. 


Using Tools for Password Management 


Most Linux distributions use shadow passwords by default, and for the most 
part, this chapter is written with the assumption that this feature is active. In 
addition to providing extra security by moving hashed passwords out of the 
world-readable etcpasswd file and into the more secure etcshadow file, shadow 
passwords add extra account information. 


One of the advantages of shadow passwords is that they support password aging 
and account expiration features. These features enable you to enforce password 
changes at regular intervals or to disable an account automatically after a 
specified period of time. You can enable these features and set the times using 
the chage command, which is described in more detail in Chapter 7. 


The usermod utility, also described in Chapter 7, can be used to adjust some 
shadow password features, such as account expiration dates. The chage 
command is more thorough with respect to account security features, but 
usermod can adjust more nonsecurity account features. 


Limiting root Access 


Because root can do anything on a Linux computer, access to that account must 


of course be limited. On a system with a single administrator, this can be 
accomplished by having the administrator set a unique root password that 
nobody else knows. This user can then log in directly as root if needed. 


Using su 


The single system administrator just described can also use the su command to 
acquire root privileges. The su command's name stands for switch user, and it's 
used to switch to another user's account. 


Typing su alone results in a prompt for the root password. If the user types that 
password correctly, the session effectively becomes a root session. 
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ING 
If you just type su to access the root account, be aware that not everything 
may be set up correctly to perform tasks that require superuser privileges. It's 
better to type the command su _ - to switch to the root account. The dash (-) 


after the su command starts a new shell environment and executes the root's 
profile. 


You can also type a username after su to acquire that user's privileges. When 
root does so, no password is required. This is sometimes handy for investigating 
problems reported by a single user. 


To run a single program with root privileges, use -c to specify the program 
name. For example, type su -c “lsof -i” torun the lsof -i command as 
root. 


Logging in directly as root is generally discouraged for several reasons: No 
record of who typed the password appears in log files; the root password can be 
intercepted in various ways; and if the user leaves the terminal, a passerby can 
hijack the computer. Using su is somewhat better than a direct login from a 
security point of view, because use of su generally leaves a trace in system logs 
of who became root. 


Using sudo 


A method of acquiring root access that is more secure than either direct logins 
or su is sudo. This program runs a single command as root; for instance, to run 
lsof -ias root, you type: 


$ sudo lsof -i 
[sudo] password for georgia: 


In this example, the computer prompts for the user's (georgia's) password, not 
for the root password. The idea behind sudo is that you first configure the 
computer to accept certain users as sudo users. Those users may then use their 
own passwords to perform superuser tasks, even if those users don't have the 
root password. 


All use of the sudo command is tracked. Pertinent data, such as who did what 


and when, is stored in the varlog/secure file. 
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Logging in as the root user can set up what is called a repudiation 
environment. A repudiation environment means that a person can deny 
actions. Therefore, if a system administrator uses the root account to 
perform some illegal or troublemaking activity, they can legally deny being 
responsible for that activity. Systems where every user has an account and 
password and no one can log into the root user's account sets up a non- 
repudiation environment. This means that actions are logged and 
responsibility for them cannot be easily denied. A non-repudiation 
environment can be created using sudo. 


You can fine-tune what tasks users may perform using sudo. This is done via the 
etcsudoers configuration file. You must edit this configuration file via visudo, 
which is a variant of the vi editor (described in Chapter 5) that's used only to edit 


etcsudoers. 

The etcsudoers file consists of two types of entries: 
Aliases 
User specifications 


Aliases are basically variables. You can use them to define groups of commands, 
groups of users, and so on. User specifications link users to machines and 
commands (possibly using aliases for some or all options). Thus, you can 
configure sudoers such that georgia can run network programs with root 
privileges but not account maintenance tools, whereas henry can run account 
maintenance tools but not network programs. 


Your default etcsudoers file probably includes several examples. Consider the 
following lines: 


$ sudo cat etcsudoers 

[sudo] password for Christine: 

[... ] 

## Storage 

Cmnd_Alias STORAGE = sbinfdisk, sbinsfdisk, sbinparted, [...] 
# 


## Processes 
Cmnd_Alias PROCESSES = binnice, binkill, /usrbinkill, [...] 
# 


[..] 
# 


%sys ALL = STORAGE, PROCESSES 
# 

%disk ALL = STORAGE 

# 

%wheel ALL=(ALL) ALL 


[..] 
$ 


This example defines two command aliases, STORAGE and PROCESSES, each of 
which stands in for a set of commands. Users who are members of the sys group 
may use both sets of commands. Users who are members of the disk group may 
use the STORAGE commands but not the PROCESSES commands. Users who are 
members of the wheel group may use all commands, whether or not they're 
explicitly mentioned in etcsudoers. 
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OK. 
If you desire to set up a non-repudiation environment, be aware that some 
commands will need to be blocked within the etcsudoers file. For example, 
a user who is a member of the wheel group in the preceding etcsudoers file 
could type sudo su - at the command line. To prevent this from occurring, 
add the command you wish to block preceded by an exclamation point (!). 
However, once you add this blocked command, you must include all of the 


allowed commands. For example, the wheel group's record may now look 
like this: 


%wheel ALL=(ALL) !binsu, bin, sbin, /usrbin, /usrsbin 


Some distributions, such as Ubuntu, make heavy use of sudo. These distributions 
are designed to be administered exclusively via sudo, and they set up an 
etcsudoers file that provides at least one user with easy access to all system 
utilities. Other distributions don't rely on sudo this way, although you can tweak 
your sudo configuration to enable administration via sudo if appropriate. 


Auditing User Access 


There are various times you may need to view system user access. It could be 
that you are looking into a potential security break, performing an investigation 
for your company's HR department, determining if anyone is still logged on 
prior to a system shutdown, and so on. There are several tools available at the 
command line to conduct such audits. 


Determining Who Is Logged On 


For determining who is currently logged onto a system, there are two primary 
commands to use: 


who 
Ww 


The who command simply shows you who is currently logged onto a system. It 
displays the username, their current terminal, and the time they logged into the 


system as follows: 


$ who 

Christine tty2 2015-11-10 11:53 
Timothy tty3 2015-11-10 12:33 
Rich tty4 2015-11-10 12:36 
[...] 

$ 


You can determine a great deal of additional information with the who command 
by using the -a option: 


$ who -a 

system boot 2015-11-11 08:17 

runlevel 5 2015-11-11 08:17 
Christine + tty2 2015-11-11 11:53 00:38 1569 
Timothy + tty3 2015-11-11 12:33 00:41 1571 
Rich + tty4 2015-11-11 12:36 00:39 3086 
LOGIN tty5 2015-11-11 08:17 1576 id=5 
LOGIN tty6 2015-11-11 08:17 1578 id=6 
acl 
$ 


The first line displayed shows when the system was booted. The second line 
shows the current system runlevel, which is 5. (See Chapter 5 for more 
information on runlevels.) The next several lines show what users are currently 
logged in, when they logged in, and their process ID (PID) numbers. 


Finally, in the previous example, you can see the virtual console terminals that 
are not currently in use, such as tty5, and the PID for the program connected to 
that terminal. You can find out more about a particular program or logged-in 
user by using the ps command along with the listed PID. For example, you can 
see that the sbinmingetty program is handling the login screen at the tty5 virtual 
console terminal: 


$ ps 1576 
PID TTY STAT TIME COMMAND 
1576 tty5 Sst 0:00 sbinmingetty devtty5 


$ 
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The who command pulls its data from the varrun/utmp or runutmp file, 
depending upon your distribution. To determine which file is used on your 
distribution by who, using superuser privileges, type locate utmp at the 
command line. 


Though a much shorter command, by default, the w command shows a 
significant amount of information concerning logged-in users: 


$ w 

13:24:25 up 5:07, 4 users, load average: 0.00, 0.00, 0.00 
USER TTY FROM LOGIN@ IDLE JCPU PCPU 
WHAT 

Christin tty2 - 11:53 48:00 1.83s 1.83s - 
bash 
Timothy tty3 - 12:33 50:32 0.31s 0.31s - 
bash 

Rich tty4 - 12:36 48:20 0.11s 0.11s - 
bash 

[...] 
$ 


The w command shows not only who is logged into the system but also what they 
are doing as well as statistics concerning CPU usage. The JcPu column shows all 
of the CPU time used by any processes currently attached to a particular virtual 
console terminal. This time includes any currently running background jobs, but 
not previously run background jobs. The PcPu column shows all of the current 
CPU time consumed by the program listed in the wHAT column. 


The w command uses the utmp file data for its display. Information stored in the 
proc directory is used by the w command as well. 


You can find out more about the w and who commands by looking through their 
man pages. While both the w and who commands are useful, they display only 
current information. If you need historical data on a particular user, there is a 
different command to use, as described in the next section. 


Determining Last Access to the System 


The last command can provide current and historical data concerning users 
logging into and out of your system. To display the information, simply type last 
at the command line. However, because there is potentially a great deal of 
information to display, it's a good idea to pipe the output into a pager, like less. 
Such a case is shown in Figure 10.1. 





Figure 10.1 The last command output 


The data displayed comes from the varlog/wtmp file. The last command 
displays the newest data first. Therefore, you should see any users currently 
logged into the system, denoted by the still logged in tag. The date and time 
shown in each user record indicates when a user logged into the system and 
when they logged out. In some cases, a user was logged into the system when 
the system shut down, as indicated by the down keyword. 
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Be aware that the varlog/wtmp file may be rotated by the logrotate utility 
(see Chapter 7 for more information on logrotate). If you need to view 
older varlog/wtmp file versions, you can use the -f option on the last 
command. For instance, if you rotate your wtmp file and an older version you 
want to view is named varlog/wtmp.1, you should type last -f 
varlog/wtmp.1 at the command prompt. 


If you want to view just a particular user's log in and out activities, you can pass 
the username as a parameter. For example, to see if anyone has been directly 


accessing the root account, enter the following: $ last root root tty3 Wed 
Nov 12 09:32 - 09:35 (00:02) root pts/O 192.168.56.1 Fri Nov 7 
10:38 - 13:04 (02:25) root tty2 Wed Oct 29 11:37 - down (02:36) 
root tty3 Fri Oct 10 08:03 - down (02:20) root tty2 Tue Sep 30 
09:44 - down (02:29) wtmp begins Tue Mar 18 15:25:03 2015 $ 


Notice in the previous example that remote accesses are also logged, along with 
their source address (192.168.56.1). Also, you can see when the varlog/wtmp 
file was started. 
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ING 
Any attempts to use su - to log in as root are not recorded in these files. 


This is another reason the use of sudo should be employed to maintain a 
non-repudiation environment on your system. 


Failed login attempts are stored in the varlog/btmp file. To see any failed login 
attempts, you can also use the last command. Just add the -f option, as shown 


in this snipped example here: $ sudo last -f varlog/btmp [sudo] password 
for Christine: root tty3 Wed Nov 12 09:35 gone - no logout root 
tty3 Wed Nov 12 09:35 - 09:35 (00:00) [..] btmp begins Sat Nov 8 
15:11:24 2015 $ 


An easier way to display this information is to use the Lastb command. The 
lastb command shows all of the failed login attempts and uses all of the same 
options as the last command. Here is a snipped example using lastb to display 


failed login attempts: $ sudo lastb [sudo] password for Christine: root 
tty3 Wed Nov 12 09:35 - 09:35 (00:00) root tty3 Wed Nov 12 09:35 - 
09:35 (00:00) [...] btmp begins Sat Nov 8 15:11:24 2015 $ 


Notice that when using both the last command and the lastb command to 
display failed login attempts, you must have superuser privileges. This is due to 
the varlog/btmp file being secured via permissions to keep attackers from 


changing failed login information as shown here: $ 1s -1 varlog/btmp -rw--- 
----. 1 root utmp 3840 Nov 12 09:35 varlog/btmp $ 


Z 


Some distributions have the dump-utmp utility. If yours does, you can dump 
out any of the files covered in this last section in a human-readable format. 
This includes the utmp files, varlog/wtmp files, and varlog/btmp files. This 
tool is helpful in producing audit reports with shell scripts. To find out more 
about this utility, type man dump-utmp at the command prompt. 


Another useful command in your auditing toolkit is the lastlog command. The 
lastlog utility pulls data from the varlog/lastlog file. You can determine 
when a particular user last logged into the system by adding the -u username 
option as shown here: 


$ lastlog -u Christine 


Username Port From Latest 
Christine’ tty3 Wed Nov 12 10:20:36 -0500 2015 
$ 


Be aware that if a particular user is logged into the system multiple times, 
lastlog will not display multiple login entries. It only shows the last time a user 
logged into the system. 


It is helpful to view every account's varlog/lastlog entry. You can use this as 
an auditing tool to determine if accounts that should not be logged into have 
been accessed. Here is a snipped example of this audit tool's display: 


$ lastlog 

Username Port From Latest 

root tty3 Wed Nov 12 09:32:51 -0500 2015 
[...] 

sshd **Never logged in** 

tcpdump **Never logged in** 

Christine tty3 Wed Nov 12 10:20:36 -0500 2015 
sally **Never logged in** 

Rich tty4 Tue Nov 11 12:36:01 -0500 2015 
Timothy tty3 Tue Nov 11 12:33:08 -0500 2015 


[..] 
$ 


As you can see from the preceding example, the sshd account has never been 
logged into, and that is a good thing! All of the auditing tools covered in this 
section can help you keep an eye on your system to discover any potential 
security breaches. However, while seeing what happened in the past is helpful, 
it's even better to put limits in place to prevent bad things from happening in the 
future. 


Setting Login, Process, and Memory Limits 


Sometimes you may want to impose limits on how many times users may log in, 
how much CPU time they can consume, how much memory they can use, and so 
on. Imposing such limits is best done through a Pluggable Authentication 
Modules (PAM) module called pam_limits. 


Most major Linux distributions use this module as part of their standard PAM 
configuration, so chances are you won't need to add it. However, you will still 
need to configure pam_limits. You do so by editing its configuration file, 
etcsecurity/limits.conf. This file contains comments (denoted by a hash 
mark, #) and limit lines that consist of four fields: 


domain type item value 


Each of these fields specifies a particular type of information: 
The Domain 


The domain field describes the entity to which the limit applies. It can be a 
username; a group name, which takes the form @groupname; or an asterisk 
(*) wildcard, which matches everybody. 


Hard or Soft Limits 


The type field specifies the limit as hard or soft. A hard limit is imposed 
by the system administrator and cannot be exceeded under any 
circumstances, whereas a user may temporarily exceed a soft limit. You 
can also use a dash (-) to signify that a limit is both hard and soft. 


The Limited Item 


The item field specifies what type of item is being limited. Examples 
include core (the size of core files), data (the size of a program's data area), 
fsize (the size of files created by the user), nofile (the number of open 
data files), rss (the resident set size), stack (the stack size), cpu (the CPU 
time of a single process in minutes), nproc (the number of concurrent 


processes), maxlogins (the number of simultaneous logins), and priority 
(the process priority). The data, rss, and stack items all relate to memory 
consumed by a program. These and other measures of data capacity are 
measured in kilobytes. 


The Value 
The final field specifies the value that's to be applied to the limit. 


As an example, consider a system on which certain users should be able to log in 
and perform a limited number of actions but not stay logged in indefinitely and 
consume vast amounts of CPU time. You can use a configuration like this one: 


@limited hard cpu 2 


This configuration applies a hard CPU limit of 2 minutes to the limited group. 
Members of this group can log in and run programs; however, if one of those 
programs consumes more than two minutes of CPU time, it will be terminated. 


P 


CPU time and total system access time are two entirely different things. 
CPU time is calculated based on the amount of time the CPU is actively 
processing a user's data. Idle time (for instance, when a user's shell is active 
but no CPU-intensive tasks are running) doesn't count. Thus, a user can log 
in and remain logged in for hours even with a very low hard CPU time limit. 
This limit is intended to prevent problems caused by users who run very 
CPU-intensive programs on systems that shouldn't be used for such 
purposes. 


Another way to set limits on system resource use is via the ulimit command. 
This command is a bash built-in command, so it affects only bash and programs 
launched from it. The ulimit syntax is as follows: 


ulimit [options [limit]] 


The options (options) define what is being limited: 


Core File Limits 


The -c option limits the size of core dumps, which are files created for 
debugging purposes in certain types of program crashes. 


File Limits 


The -f option limits the size of files that may be created by the shell, and -n 
limits the number of open file descriptors. (Most systems don't honor the -n 
limits, though.) 


Process Limits 


The -u option limits the number of processes a user may run, and -t limits 
the total CPU time in seconds. 


Memory Limits 


The -v option sets the total amount of virtual memory available to the shell, 
-s sets the maximum stack size, -m sets the maximum resident set size, -d 
limits programs' data set size, and -1 sets the maximum size that may be 


locked into memory. 
Hard and Soft Limits 


The -H and -S options modify other options, causing them to be set as hard 
or soft limits, respectively. Hard limits may not be subsequently increased, 
but soft limits may be. If neither option is provided, ulimit sets both the 
hard and soft limits for the feature specified. 


Current Settings 
Passing -a causes ulimit to report its current settings. 


The limit variable is typically a numeric value associated with the limit. The 
ulimit command is often found in system or user bash Startup scripts, typically 
as ulimit -c 0, in order to prevent creation of core files, which can sometimes 
clutter a filesystem. If your users perform software development, you may want 
to ensure that you do not set this limit, or at least set it as a soft limit (as in 
ulimit -Sc @) so that users may override it when necessary. 


Lh 
ON. 
Because ulimit is a bash built-in command, its utility as a system security 
tool is limited. If users have access to GUI login tools or can log into the 
system in any way that bypasses bash (such as via SSH, depending on how 
it's configured), restrictions imposed by ulimit become meaningless. Thus 


you should treat ulimit as a way to prevent problems because of accidental, 
rather than intentional, abuse of the system. 


One particular interesting limit involves the use of the etcnologin file. If this 
file is present, only root may log into the computer. Other users are shown the 
contents of this file when they attempt to log in. 


In many respects, using etcnologin is like setting critical system limits to 0 for 
all other users. This file can be useful on dedicated server systems that have no 
regular console or remote shell users. 


Locating SUID/SGID Files 


Chapter 4, “Managing Files,” describes the SUID and SGID bits. In brief, these 
are special flags that may be applied to executable program files. These flags 
cause Linux to treat the program as if it were run by the program file's owner 
(for SUID) or by the file's group (for SGID) rather than by the individual 
actually running the program. For instance, if a program's SUID bit is set and the 
program file is owned by bruce, the program, when run by anybody, will be able 
to access all of the files owned by bruce and otherwise behave as if bruce is 
running it. 


Zz 


The SUID and SGID bits are frequently associated with the root account in 
order to enable them to perform tasks that require special privilege. For 
instance, the passwd program (described in Chapter 7) is SUID root because 
only root may modify the Linux password database. Thus, for an ordinary 
user to change a password, some mechanism must exist to run a process as 
root. That mechanism, in the case of passwd, is the SUID bit. 


The problem is that the SUID and SGID bits can be security risks. For instance, 
suppose the rm program's SUID bit was set. This program is normally owned by 
root, so setting the SUID bit on rm would mean that any user could delete any 
file on the computer! Although no Linux distribution sets the SUID bit on rm by 
default, the SUID bit can be set inappropriately or set by an attacker. For these 
reasons, you should periodically audit your system to find all of the SUID and 
SGID programs and, if appropriate, change their permission settings. 


To do this, you can use the find command (see Chapter 4). In particular, you 
can use the -perm mode option, which searches for files with the specified 
permission mode. To search for SUID and SGID files, you should pass a mode 
value of +6000. The symbolic representation for both the SUID and SGID bits is 
6000, and the plus sign (+) tells find to locate any file with any of the specified 
bits set. You may also want to pass the -type f option, which restricts the 
search to regular files. (Directories use the SUID and SGID bits differently, as 
described in Chapter 4.) Thus, to search the entire computer for SUID and SGID 


programs, you type this: $ sudo find / -perm +6000 -type f [sudo] 
password for Christine: /lib64/dbus-1/dbus-daemon-launch-helper 
homeChristine/bigprogram.sh sbinpam_timestamp_check sbinnetreport 
sbinunix_chkpwd [...] $ 


Z 


You can search for SUID files alone by passing +4000 or -u=s. Also, you 
can search for SGID alone by passing +2000 or -g=s. 


The result is a list of files, one per line, that have either the SUID or the SGID 
bits set. Programs that are likely to be present in this list include su, ping, mount, 
passwd, umount, and sudo. These programs all have a legitimate need to be so 
configured. 


Most systems have additional SUID and SGID programs, some of which may 
seem trivial. If you have doubts about whether the program really needs SUID or 
SGID status, you should investigate further. Try verifying the package integrity 
using your package management tools and perform a Web search on the program 
name and SUID or SGID, as appropriate. You can also try changing the SUID 
status of the program using chmod, as described in Chapter 4, and see if it still 
works as it should when run by a normal user. 


Lh 
Programs that are SUID or SGID root, but shouldn't be, can be a sign of 
compromised system. Attackers might reconfigure programs this way in 


order to cause trouble more easily. Thus, if you find such programs, 
investigate the overall integrity of the system. 


Configuring SSH 


In the past, Telnet was the remote text-mode login protocol of choice on Linux 
and Unix systems. Unfortunately, Telnet is severely lacking in security features. 
Thus, in recent years SSH has grown in popularity, and it is now the preferred 
remote login tool. SSH can also handle file transfer tasks similar to those of FTP. 
For these reasons, knowing how to configure SSH can be very helpful. This task 
requires knowing a bit about SSH generally and about the SSH configuration 
files within Linux. 


PP 
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SSH is complex enough that only its basics are covered in this chapter. For 
more details, consult OpenSSH's documentation or a book on the topic, such 
as SSH, The Secure Shell: The Definitive Guide, Second Edition, by Daniel J. 
Barrett, Richard Silverman, and Robert G. Bymes (O'Reilly, 2005) or SSH 
Mastery: OpenSSH, PuTTY, Tunnels and Keys (CreateSpace, 2012) by 
Michael W. Lucas. 


Understanding SSH Basics 


Linux supports remote login access through several different servers, including 
Telnet, Virtual Network Computing (VNC), and even X. Unfortunately most of 
these methods suffer from a major drawback: they transfer data over the network 
in an unencrypted form. This fact means that anybody who can monitor network 
traffic can easily snatch sensitive data, often including passwords. (VNC and a 
few other protocols encrypt passwords but not other data.) This security 
limitation keeps these remote login tools from being highly useful. If using a 
remote access tool means that you'll be giving away sensitive data or 
compromising your entire computer, it's not a very useful tool. 


Lh 
ING 
Use these nonencrypting remote access tools at your own risk. It is better to 
not use them. 


SSH was designed to close this potential major security hole by employing 
strong encryption techniques for all parts of the network connection. SSH 
encrypts the password exchange and all subsequent data transfers, making it a 
much safer protocol for remote access. 


In addition to encryption, SSH provides file transfer features and the ability to 
tunnel other network protocols. This feature enables nonencrypted protocols to 
piggyback their data over an SSH connection, thus delivering SSH's encryption 
advantages to other protocols. 
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The main drawback of SSH is that the encryption and decryption consumes 
CPU time. This fact slows down SSH connections compared to those of 
direct connections and can degrade overall system performance. If you 
tunnel a protocol that transfers much more data, you may see a greater 
performance drop when using SSH. However, the improved security is 
generally worth the slight speed cost. 


Several SSH servers are available for Linux, but the most popular by far is the 
OpenSSH server (www. openssh.org). This program was one of the first open 
source implementations of the SSH protocol. OpenSSH ships with most Linux 
distributions. 


OpenSSH may be launched either via the xinetd super daemon or via a startup 
script. Most distributions deliver suitable startup scripts with their SSH 
packages. 


If you make changes to your SSH configuration, you may need to pass the 
reload or restart option to the startup script, as in etcinit.d/sshd reload. 
(Chapter 5 covers startup scripts in more detail.) However it's launched, the 
OpenSSH server binary name is sshd. 


Setting SSH Options 


For the most part, SSH works reasonably well when it's first installed, so you 
may not need to make any changes to its configuration. If you do need to make 
changes, though, these are mostly handled through the main SSH configuration 
file, etcssh/sshd_config. You can also edit some additional files to limit access 
to the SSH server or to change how SSH manages the login process. 


Configuring Basic SSH Features 


The etcssh/sshd_config file consists mainly of option lines that take the 
following form: 


option value 


phi 
ING 
Don't confuse the sshd_config file with the ssh_config file. The former 


controls the OpenSSH server, whereas the latter controls the SSH client 
program, ssh. 


In addition to configuration lines, the sshd_config file holds comments, which 
are denoted by hash marks (#). Most sample configuration files include a large 
number of SSH options that are commented out. These lines specify the default 
values, so removing a line's hash mark without otherwise changing the value will 
have no effect. 


Most options’ default values are suitable for most systems. The following list 
includes some that you may want to check and, perhaps, change: 


Protocol 


This option specifies the protocol levels OpenSSH understands. Possible 
values are 1 and 2. You can configure OpenSSH to support both protocols 
by separating them by a comma, as in 1, 2 or 2,1, which are equivalent. 
OpenSSH protocol level 1 is no longer considered secure. Therefore, the 
safest configuration is to set Protocol 2. This limits the server's ability to 
communicate with older clients, though. 


PermitRootLogin 


By default, this option is set to yes, which enables OpenSSH to accept 
direct logins by root. This is safer than a similar configuration under 
Telnet, but for a bit of added security, set this value to no. The result will be 
that anybody wanting to perform remote work using superuser privileges 
will need first to log in as an ordinary user. 


X11Forwarding 


This option specifies whether OpenSSH's X tunneling features should be 
active. If you want to enable remote users to run GUI programs via SSH, 
you must set this option to yes. Doing so can slightly degrade security of 
the client's X display, though, depending on certain other options, hence the 
conservative default value of no. 


For information about additional options, consult the man page for sshd_config. 
If you make changes to the SSH configuration, remember to restart it using the 
server's startup script. 


Managing SSH Keys 


Part of SSH's security involves encryption keys. Each server system and each 
user has a unique number, or key, for identification purposes. In fact, SSH uses a 
security system that involves two keys: a public key and a private key. These two 
keys are mathematically linked in such a way that data encrypted with a 
particular public key may be decrypted only with the matching private key. 


When establishing an SSH connection, each side sends its public key to the 
other. Thereafter, each side encrypts data with the other side's public key, 
ensuring that only the intended recipient can decrypt the data. In practice, this is 
just the first step of the process, but it's critical. What's more, SSH clients 
typically retain the public keys of servers they've contacted. This enables them to 
spot changes to a public key. Such changes can be signs of tampering, so if a 
client detects such a change, it will warn its user of this fact. 


Most OpenSSH server startup scripts include code that looks for stored public 
and private keys and, if they're not present, generates them. In total, four to six 
keys are needed: public and private keys for two or three encryption tools that 
SSH supports. These keys are normally stored in etcssh and are called 
ssh_host_rsa_key and ssh_host_dsa_key for private keys, depending on the 
encryption algorithm used. For public keys, the same filenames are used, except 
a .pub filename extension is added to the file's name. Some systems also add 
ssh_host_rsai_key and its associated public key. 


If your system doesn't have these keys and you can't get the SSH server to start 
up, you can try generating the keys with the following ssh- keygen commands: 


# ssh-keygen -q -t rsai -f etcssh/ssh_host_key -C " -N " 
# ssh-keygen -q -t rsa -f etcssh/ssh_host_rsa_key -C " -N " 
# ssh-keygen -q -t dsa -f etcssh/ssh_host_dsa_key -C " -N " 


Each of these commands generates both a private key (named in the -f 
parameter) and a public key (with the same name but with . pub appended). 


Don't run these ssh- keygen commands if the SSH key files already exist! 
Replacing the working files will cause clients who've already connected to the 
SSH server to complain about the changed keys and possibly refuse to establish 
a connection. 
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Be sure the private keys are suitably protected; if an intruder obtains one of 
these keys, the intruder can impersonate your system. Typically, these files 
should have 0600 (-rw------- ) permissions and be owned by root. The 


public key files (with .pub filename extensions) should be readable by all 
users, though. 


When you configure a client system, you may want to consider creating a global 
cache of host keys. As already noted, the ssh program records host keys for each 
individual user. (It stores these in the ~/.ssh/known_hosts file.) When you set 
up the client, you can populate the global ssh_known_hosts file, which is 
normally stored in /etc or etcssh. Doing so ensures that the public key list is as 
accurate as the sources you use to populate the global file. It also eliminates 
confirmation messages when users first connect to the hosts whose keys you've 
selected to include in the global file. 


How do you create this file? One simple way is to copy the file from a user 
account that's been used to connect to the servers you want to include, as shown 
here: 


$ sudo cp homeRich/.ssh/known_hosts etcssh/ssh_known_hosts 
[sudo] password for Christine: 
$ 


zx 


In the past, you could review SSH's known hosts file in a text editor since it's 
a text-mode file. Now OpenSSH v4.0 and newer versions support hashing 
this file's data. When this feature is enabled, the information is hashed and 
stored. The idea is that you'll still be able to authenticate SSH servers to 
which you connect because a hash of the typed hostname will match a hash 
of the stored hostname. However, if an attacker steals your known hosts file, 
the attacker will be unable to determine the identities of the computers to 
which you've been connecting. An unfortunate side effect of this hashing is 
that you can't tell what servers it describes yourself. 


Controlling SSH Access 


You can limit who may access an SSH server in various ways. The most obvious 
and basic method is via password authentication. The usual SSH authentication 
method is to employ a username and password, much as Telnet does. The ssh 
client program sends the username automatically or as part of the command line. 
Therefore, you won't see a username prompt when logging in via ssh, as shown 
in the example here: 


$ ssh Christine@192.168.56.101 
Christine@192.168.56.101's password: 
Last login: Wed Nov 12 10:20:36 2015 
$ 


The ssh command syntax requires the username to be placed before the @ 
symbol, as shown in the previous example. After the @ symbol, the remote host's 
IP address or name is required. Once the connection is established, the 
username's password must be entered before access to the remote system is 
allowed. 


Beyond password authentication, SSH supports several other types of 
limitations: 


TCP Wrappers 


If you run SSH from a super server or if the server was compiled with TCP 


wrappers support, you can use the etchosts.allow and etchosts.deny 
files to limit access by IP address. Note that if you launch SSH via a system 
startup script, this approach works only if the server was compiled to 
support it. This support may or may not be present in your distribution's 
standard SSH package. 


Firewalls 


As with all servers, you can restrict access by using a firewall. SSH uses 
TCP port 22. Technically, this isn't an SSH feature, but it's certainly useful 
for protecting an SSH server. 


etcnologin 


If this file is present, SSH honors it. As described earlier, this file's presence 
means that only root may log in. When a non-root user tries to log in 
locally, the file's contents are displayed as an error message. However, 
OpenSSH doesn't do this. 


Copying Files via SSH 


Besides remote login access, SSH includes a file-copying command too: scp. 
This command works much like the cp command for copying files locally. 
However, you must specify the target computer, and optionally the username, 
just before the target filename. For instance, to copy the file masterpiece.c to 
the lisa account on leonardo.example.com, you would type this: 


$ scp masterpiece.c lisa@leonardo.example.com: 
$ 


The colon (:) that terminates this command is extremely important! If you omit 
it, you'll find that scp works like cp, and you'll end up with a file called 
lisa@leonardo.example.com on the original system. 


If you want to rename the file, you can do so by including the new name 
following the colon. Likewise, you can place the file in a particular directory in 
the same way, as follows: 


$ scp masterpiece.c lisa@leonardo.example.com:~/art/mona.c 
$ 


This example copies masterpiece.c to the ~/art directory on the target 
computer and renames it mona.c. If the specified directory doesn't exist, an error 
results and the file is not transferred. If you specify a directory without a trailing 


slash or filename and you mistype the directory name, scp will copy the file and 
rename it to your mistyped directory name. (scp works just like cp in this 
respect.) 


Configuring Logins without Passwords 


If you use SSH a lot or if you use it in automated tools, you'll no doubt become 
annoyed by the need to type a password with every connection. There is a way 
around this requirement: You can set up the SSH client with keys and give the 
client's public key to the server computer. With this configuration, the SSH 
client computer can identify itself, possibly obviating the need for you to type a 
password. 
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Configuring SSH to operate without the use of passwords is convenient, but 
it does increase security risks. If somebody you don't trust ever gains access 
to your account on the SSH client system, that person will be able to log into 
the SSH server system as you without the benefit of your password. Thus, 
you should create a password-less login only from a client that's very well 


protected, if at all. Configuring access to the root account in this way is 
particularly risky! 


To configure SSH not to require a password, follow these steps: 


1. Log into the SSH client system as the user who will be performing remote 
access. 


2. Type the following command to generate a version 2 SSH key: 


$ ssh-keygen -q -t rsa -f ~/.ssh/id_rsa -C " -N " 
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Step 2 generates a version 2 key. You can instead generate a version 1 
key by typing ssh-keygen -q -t dsa -f ~/.ssh/id_dsa -C ” -N ”. 
This generates id_dsa and id_dsa. pub files. This procedure is not 
recommended because SSH version 1 is not as secure as version 2. 
However, these key files are listed in the certification objectives. 


3. Step 2 generates two files: id_rsa and id_rsa.pub. Transfer the second of 
these files to the SSH server computer in any way that's convenient—via a 
USB flash drive, by using scp, or by any other means. Copy the file under a 
temporary name, such as temp.rsa. 


4. Log into the SSH server system. If you use SSH, you'll need to type your 
password. 


5. Add the contents of the file that you've just transferred to the end of the 
~/.ssh/authorized_keys file. (This file is sometimes called 
~/.ssh/authorized_keys2, so you should check to see which is present. If 
neither is present, you may need to experiment.) Typing cat ~/temp.rsa 
>> ~/.ssh/authorized_keys should do this job, if you stored the original 
file as ~/temp.rsa. 


6. On some systems, you may need to modify permissions on the 
~/.ssh/authorized_keys file and on the directories leading to it. The 
authorized_keys file may require 0600 permissions, and you may need to 
remove write permissions for any but the account's owner on your home 
directory and on the ~/.ssh directory. 


If you now log out of the SSH server system and try to log in again via SSH 
from the client, you shouldn't be prompted for a password; the two computers 
handle the authentication automatically. 


If this doesn't work, chances are the ~/.ssh/authorized_keys file needs another 
name, as described earlier. You may also want to check that the file includes a 
line matching the contents of the original public-key file on the client. Some 
older clients may require you to specify that you use version 2 of the SSH 
protocol by including the -2 option: 


$ ssh -2 server 


Using ssh-agent 


Another SSH authentication option is to use the ssh-agent program. This 
program requires a password to initiate connections, so it's more secure than 
configuring logins without passwords; however, ssh-agent remembers your 
password, so you need to type it only once per local session. To use ssh-agent, 
follow these steps: 


1. Follow the procedure for enabling no-password logins described in 
“Configuring Logins without Passwords,” but with one change: Omit the -N 
” option from the ssh-keygen command in step 2. You'll be asked for a 
passphrase at this step. This passphrase will be your key for all SSH logins 
managed via ssh-agent. 


2. On the SSH client system, type ssh-agent binbash. This launches ssh- 
agent, which in turn launches bash. You'll use this bash session for 
subsequent SSH logins. 


3. In your new shell, type ssh-add ~/.ssh/id_rsa. This adds your RSA key 
to the set that's managed by ssh-agent. You'll be asked to type your SSH 
passphrase at this time. 


From this point on, whenever you use SSH to connect to a remote system to 
which you've given your public key, you won't need to type a password. You 
will, however, have to repeat steps 2 and 3 whenever you log out, and the 
benefits will accrue only to the shell launched in step 2 or any shells that you 
launch from that one. 


If you make heavy use of this facility, you can insert ssh-agent into your 
normal login procedure. For instance, you can edit etcpasswd so that ssh-agent 
binbash is your login shell. For a GUI login, you can rename your normal GUI 
login script (for instance, change ~/. xsession to ~/.xsession-nossh) and 
create anew GUI login script that calls ssh-agent with the renamed script as its 
parameter. Either action inserts ssh-agent at the root of your user process tree 
so that any call to SSH uses ssh-agent. 


Using SSH Login Scripts 


Ordinarily, an SSH text-mode login session runs the user's configured shell, 
which runs the shell's defined login scripts. The OpenSSH server also supports 
its own login script, sshrc (normally stored in /etc or etcssh). The OpenSSH 


server runs this script using binsh, which is normally a symbolic link to bash, so 
you can treat it as an ordinary bash script. 


Setting Up SSH Port Tunnels 


SSH has the ability to extend its encryption capabilities to other protocols, but 
doing so requires extra configuration. The way this is done is known as 
tunneling. Chapter 6 described a special type of SSH tunneling involving X, but 
the process can work for other protocols. 


Figure 10.2 illustrates the basic idea behind an SSH tunnel. The server computer 
runs two server programs: a server for the tunneled protocol (Figure 10.2 uses 
the Internet Mail Access Protocol, IMAP, as an example) and an SSH server. 
The client computer also runs two clients: one for the tunneled protocol and one 
for SSH. The SSH client also listens for connections for the tunneled protocol; 
it's effectively both a client and a server. When the SSH client receives a 
connection from the tunneled protocol's client, the result is that the tunneled 
protocol's connection is encrypted using SSH, tunneled to the SSH server, and 
then directed to the target server. Thus, data passes over the network in 
encrypted form, even if the target protocol doesn't support encryption! 
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Figure 10.2 An SSH tunnel extends SSH's encryption benefits to other 
protocols. 


Of course, all of this requires special configuration. The default configuration on 
the server enables tunneling, but to be sure, check the etcssh/sshd_config file 
on the server for the following option: 


AllowTcpForwarding no 


If this line is present, change no to yes. If it's not present or if it's already set to 
yes, you shouldn't need to change your SSH server configuration. 


On the client side, you must establish a special SSH connection to the server 
computer. You do this with the normal ssh client program, but you must pass it 
several parameters. An example will help illustrate this use of ssh: 


$ sudo ssh -N -f -L 142:mail.luna.edu:143 benf@mail. luna. edu 
$ 


The -N and -f options tell ssh not to execute a remote command and to execute 
in the background after asking for a password, respectively. These options are 
necessary to create a tunnel. 


The -L option specifies the local port on which to listen, the remote computer to 
which to connect, and the port on the remote computer to which to connect. This 
example listens on the local port 142 and connects to port 143 on 
mail.luna.edu. 


The final parameter (benf@mail.1luna.edu in this example) is the remote 
username and computer to which the tunnel goes. Note that this computer need 
not be the same as the target system specified via -L. 


vag 


A JTE 


If you want SSH on the client system to listen to a privileged port (that is, 
one numbered below 1024), you must execute the ssh program as root, as 
shown in the preceding example. If listening to a nonprivileged port is 
acceptable, the ssh client can be run as a normal user. 


With the tunnel established, you can use the client program to connect to the 
local port specified by the first number in the -L parameter (port 142 in the 
preceding example). For instance, this example is intended to forward IMAP 
traffic, so you'd configure a mail reader on the client to retrieve IMAP email 
from port 142 on localhost. When the email reader does this, SSH kicks in and 
forwards traffic to the SSH server, which then passes the data on to the SSH 
server computer's local port 143, which is presumably running the real IMAP 
server. 


All of this is hidden from the email reader program. As far as the reader program 
is concerned, it is retrieving email from a local IMAP server. 


Preventing SSH Security Problems 


SSH is intended to solve security problems rather than create them. Indeed, on 
the whole, using SSH is superior to using Telnet for remote logins, and SSH can 
also take over FTP-like functions and tunnel other protocols. Thus, SSH is a big 
security plus compared to using less-secure tools. 


Like all servers, though, SSH can be a security liability if it's run unnecessarily 
or inappropriately. Ideally, you should configure SSH to accept only protocol 
level 2 connections and to refuse direct root logins. If X forwarding is 
unnecessary, you should disable this feature. If possible, use TCP wrappers or a 
firewall to limit the machines that can contact an SSH server. As with all servers, 
you should keep SSH up to date; there's always the possibility of a bug causing 
problems. 


You should consider whether you really need a remote text-mode login server. 
Such a server can be a great convenience—often enough to justify the modest 
risk involved. For extremely high-security systems, though, using the computer 
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One unusual security issue with SSH is its keys. As noted earlier, the private-key 
files are extremely sensitive and should be protected from prying eyes. 
Remember to protect the backups of these files as well. Protect system backup 
files as securely as you would the originals. 


Using GPG 


SSH is designed to encrypt interactive login sessions and file transfers. 
Sometimes, though, another type of encryption is desirable: You may want to 
encrypt messages sent via email or files sent to another person via some other 
means. Email was never designed as a secure data transfer tool, and most email 
messages pass through several email servers and network routers. A compromise 
at any one of these points enables an attacker to look at email traffic and extract 
sensitive data. Encrypting your email keeps such details private. 


The usual tool for encrypting email is the GNU Privacy Guard package (GPG or 
GnuPG, www.gnupg.org). This package is an open-source reimplementation of 
the proprietary Pretty Good Privacy (PGP). In addition to encrypting entire 
messages, GPG enables you to “sign” messages digitally. 


Generating Keys 


To begin using GPG, if your distribution does not install the GPG software 
package by default, you will need to install the software (see Chapter 2). 
Chances are that if it's not installed by default, your distribution does include it 
in its repositories. 


The next step is to generate keys. GPG keys are conceptually similar to SSH 
keys: You need a private key (aka a secret key) and a public key. As the names 
imply, the private key is kept private, but the public key is publicly available. 
You can sign your messages with your private key, and readers can verify it with 
your public key. Also, you can encrypt a message with another user's public key, 
and it can be decrypted only with that user's private key. 


To generate keys, you use the gpg program with its - - gen-key option: 
$ gpg --gen-key 


The program will ask you a series of questions. In most cases, answering with 
the defaults should work well, although you may have to type in your full name 
and email address. The keys are stored in a keyring (a file that holds keys) in the 
~/.gnupg directory. 
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One question that you are asked when generating keys for gpg is the key 
size. Generally, the larger the key size, the more secure the encryption. Pick 
a key size that is at least 2,048 bits or larger. 


Once you've generated your keys, you can export your public key: 


$ gpg --export name > gpg.pub 


This command saves the public key associated with name in the file gpg. pub. 
You can use your email address as name. If you create additional public keys or 
add others' public keys to your keyring, you specify those keys' names to export 
those keys. 


After exporting your public key to a file, you can then make your public key 
available to others so that they may encrypt files to be sent to you or verify your 
signed messages. Adding the --armor option to the gpg --export command 
produces ASCII output, which may be preferable if you intend to email the key 
file. You can make the file accessible on your website, transfer it as an email 
attachment, or distribute it in various other ways. 
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Some distributions use gpg2 instead of the command gpg. If you have gpg2, 
you can use the same options as gpg. However, be sure to read through the 
gpg2 man pages. You may find that you want to install gpg alongside the 
gpg2 package. 


One important method of distributing your public key is via a keyserver. This is 
a network server that functions much like a keyring. To send your public key to 
a keyserver, you can use the - -keyserver hostname and --send-keys keyname 


options to gpg, as follows: $ gpg --keyserver pgp.mit.edu --send-keys 
jennie@luna.edu 


This example sends the public key for jennie@luna. edu from your public 
keyring to the server at pgp.mit.edu. Thereafter, anybody who wants to can 
retrieve the key from that server. The pgp.mit .edu server is a popular site for 
hosting PGP public keys. 


Importing Keys 


To encrypt a file you send to others, you must obtain their public keys. Ask your 
correspondents how to obtain them. Once you've done so, you can add their keys 
to your keyring (that is, the set of keys GPG maintains): 


$ gpg --import filename 


This command adds filename to your set of public keys belonging to other 
people. 
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Although public keys are, by definition, public, there are security concerns 
relating to them. Specifically, you should be sure to use a legitimate public 
key. Hypothetically, a troublemaker could publish a fake public key in order 
to obtain sensitive communications or fake a signed email. For instance, 
George might distribute a fake GPG public key that claimed to be from 
Harold. George could then either sign messages claiming to be from Harold 
or intercept email sent to Harold that was encrypted using the fake key. 


Thus, you should use a communication method that is as secure as possible 
to distribute your public key and to receive public keys from others. 


Once you've created your own key and, perhaps, imported keys from others, you 
can see what keys are available by using the - -list-keys option to gpg: 


$ gpg --list-keys 
homegjones/.gnupg/pubring.gpg 


pub 
uid 
sub 
pub 
uid 
sub 


1024D/190EDB2E 


2048g/0D657AC8 
1024D/A8B2061A 


2048g/4F33EF6B 


2015-09-05 

George A. Jones <gjones@example.com> 
2015-09-05 

2015-09-05 

Jennie Martin <jennie@luna.edu> 
2015-09-05 


The uid lines contain identifiers that you'll use when encrypting or decrypting 
data, so you should pay particular attention to that information. 
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Cryptoparties are a popular way to exchange public keys. A group of friends 
gather together for an evening, each bringing a flash drive containing their 
own public key. One friend also brings a computer. The friends use the 
computer to swap public keys. At the end of the evening, the friends have 
had a good time socializing and get to take home their flash drives with 
everyone's public keys on it. 


Revoking a Key 


Sometimes, you might have cause to revoke a public key. For instance, suppose 
that you've stored a copy of your private key on a laptop computer and that 

laptop is stolen, or perhaps some employees have left your organization and you 
no longer want those individuals to be able to use the keys associated with their 
employee accounts. To revoke a key, you use the --gen- revoke keyname option 


to gpg: 


$ gpg --gen-revoke jennie@luna. edu 


The program asks you to answer a few questions, such as the reason for revoking 
the key. It then generates a key block, such as the following: 


-===> BEGIN PGP PUBLIC KEY BLOCK-----Version: GnuPG v2.0.19 
(GNU/Linux)Comment: A revocation certificate should follow 
1EwEIBECAAWFALBPVbkFHQBG28bACgkQbBimvBMO2y4uzwCeQiLkZx8j12 
jk+ hnOOKUL3ZEZNMBQAN2WvtuQw+AP6wlvOvNU/gYi8a7t8=s0/s 

-===> END PGP PUBLIC KEY BLOCK----- 


You should copy this text into a file (say, revocation. gpg) and import the file 
to your keyring: 


$ gpg --import revocation. gpg 


If you've distributed public keys associated with the revoked key, you should 
distribute this revocation too. If you've sent your public keys to a GPG 
keyserver, you Can pass your revocation along in the same way that you sent 
your original public key: 


$ gpg --keyserver pgp.mit.edu --send-keys jennie@luna. edu 


Once this is done, you can generate and distribute a new set of keys, if desired. 


Encrypting and Decrypting Data 


To encrypt data, you use gpg with its - -out and - -encrypt options and, 
optionally, --recipient and --armor: 


$ gpg --out encrypted-file --recipient uid --armor --encrypt 
original -file 


You can use the UID froma gpg --list-keys output, or just the email address 
portion, as the uid in this command. If you haven't signed the recipient's key, 
you'll have to verify that you want to use that key. The result is a new file, 
encrypted- file, which holds an encrypted version of original- file. 


If you omit the - -armor option, the resulting file is a binary file. To send the 
binary file through email, you'll need to send it as an attachment. If you include 
the --armor option, the output is ASCII, so you can cut and paste the encrypted 
message into an email or send it as an attachment. 


If you receive a message or file that was encrypted with your public key, you can 
reverse the encryption by using the --decrypt option: 


$ gpg --out decrypted-file --decrypt encrypted-file 


You'll be asked to enter your passphrase. The result should be a decrypted 
version of the original file. 


In practice, GPG can be even easier to use than this description may make you 
think. GPG is primarily used to secure and verify email, so most Linux email 
clients provide GPG interfaces. These options call gpg with appropriate options 
to encrypt, sign, or decrypt messages. Details vary from one email client to 
another, so you should consult your email client's documentation for details. 


Signing Messages and Verifying Signatures 


As noted earlier, GPG can be used to sign messages so that recipients know that 
they come from you. To do so, use the - -sign or --clearsign option to gpg: 


$ gpg --clearsign original-file 


The --sign option creates a new file with the same name as the original, but 


with .gpg appended to the filename. This file is encrypted using your private key 
so that it may be decrypted only with your public key. This means that anybody 
with your public key may read the message, and anybody who can read it knows 
that it's from you. 


The --clearsign option works similarly, but it leaves the message text 
unencrypted and only adds an encrypted signature that can be verified by using 
your public key. The --clearsign option creates a file with a name that ends in 
»asc. 


If you receive a signed message, you can verify the signature using the - - verify 
option to gpg: 


$ gpg --verify received-file 


If any of the keys in your keyring can decode the message or verify the 
signature, gpg displays a Good signature message. To read a message that was 
encrypted via the --sign option, you must decrypt the message via the - - 
decrypt option, as described earlier. 


Summary 


Maintaining system security is both important and time-consuming. A great deal 
of security emphasis is on network security. To achieve a high level of network 
security, properly configuring the server's super daemon and disabling unused 
servers goes a long way. Attending to passwords and performing miscellaneous 
tasks to keep your local accounts from becoming security risks are also 
important security tasks. 


Encryption is a hot topic in security. SSH is a protocol and tool that can handle 
many network encryption tasks by encrypting two-way connections between 
computers. Typically used as a remote login protocol, SSH can also be used to 
transfer files or encrypt other protocols. When you want to encrypt data sent to 
another individual via a tool such as email, you can do so with the help of GPG. 
This package enables you to encrypt individual files, which can then be attached 
to or embedded in email messages and decrypted by the recipient. 


Exam Essentials 


Identify the purpose of a super server. 


Super servers (also called super daemons), such as inetd and xinetd, 
manage incoming network connections for multiple servers. They can add 
security and convenience features, and they can help to minimize the 
memory load imposed by seldom-accessed servers. 


Explain the function of super server port access controls. 


Super servers or programs called by them (such as TCP wrappers) can 
restrict access to ports for the servers they manage. These restrictions occur 
at a higher level than a firewall's restrictions, and they apply only to the 
servers managed by the super server. 


Summarize the tools that you can use to identify the servers running on 
a computer. 


The netstat and lsof programs both provide options to list all (or a subset 
of) the open network connections as well as programs that are listening for 
connections. Remote network scanners, such as Nmap, can probe another 
computer for open network ports. The fuser program can determine the 
processes currently using a particular network port. Perusal of local 
configuration files can also provide clues as to what's running on a 
computer. 


Describe why SUID and SGID programs are potentially risky. 


The set user ID (SUID) and set group ID (SGID) bits tell Linux to run the 
program as the user or group that owns the file. This is particularly risky 
when root owns the program file because it essentially elevates all users to 
root for the purposes of running the file, making bugs in the program more 
dangerous and raising the possibility of a clever user abusing the program 
to acquire full root privileges or otherwise wreaking havoc. 


Explain why shadow passwords are important. 


Shadow passwords store password hashes in a file that can't be read by 
ordinary users, thus making it harder for attackers on the local system to 
read the hashed passwords and use brute-force attacks to discover other 
users’ passwords. Modern Linux distributions use shadow passwords by 
default. 


Explain how to generate a good password. 


Ideally, passwords should be random. Failing that, one good approach is to 
generate a base that's hard to guess and then modify it by adding digits and 
punctuation, changing the case of some characters, changing letter order, 
and significantly increasing the length of the password (even with repeated 
characters). 


Explain why SSH is the preferred remote text-mode login tool. 


The Secure Shell (SSH) protocol provides encryption for all traffic, 
including both the password exchange and all subsequent data exchanges, 
whereas older tools, such as Telnet, do not. This makes SSH much safer for 
the exchange of sensitive data, particularly over untrusted networks such as 
the Internet. 


Identify the most important SSH configuration file. 


The SSH server is controlled through the etcssh/sshd_config file. The 
SSH client configuration file is etcssh/ssh_config; don't confuse the two. 


Describe the SSH public and private key files 


These keys are normally stored in the etcssh/ directory. Private key files 
are called ssh_host_rsa_key, ssh_host_rsai_key, and 
ssh_host_dsa_key, depending on the encryption algorithm used. Public 
key files have the same filenames as their private keys, except a .pub 
filename extension is added. 


Describe the function of GPG. 


GPG enables public-key encryption of individual files or email messages. 
You can use GPG to encrypt sensitive data for transmission over email or 
other insecure means. 


Review Questions 


1. Typing lsof -i | grep LISTEN as root produces three lines of output, 
corresponding to the sendmail, sshd, and proftpd servers. What can you 
conclude about the security of this system? 


A. Everything is OK; the presence of sshd ensures that data are being 
encrypted via SSH. 


B. The sendmail and sshd servers are OK, but the FTP protocol used by 
proftpd is insecure and should never be used. 


C. The sendmail server should be replaced by Postfix or qmail for improved 
security, but sshd and proftpd are fine. 


D. Because sendmail and proftpd both use unencrypted text-mode data 
transfers, neither is appropriate on a network-connected computer. 


E. No conclusion can be drawn without further information; the listed servers 
may or may not be appropriate or authentic. 


2. As part of a security audit, you plan to use Nmap to check all of the computers 
on your network for unnecessary servers. Which of the following tasks 
should you do prior to running your Nmap check? 


A. Back up etcpasswd on the target systems to eliminate the possibility of it 
being damaged. 


B. Obtain the root passwords to the target systems so that you can properly 
configure them to accept the Nmap probes. 


C. Obtain written permission from your boss to perform the Nmap sweep. 


D. Configure etcsudoers on the computer you intend to use for the sweep, to 
give yourself the ability to run Nmap. 


E. Disable any firewall between the computer that's running Nmap and the 
servers you intend to scan. 


3. Your login server is using PAM, and you want to limit users' access to system 
resources. Which configuration file will you need to edit? 


A. etclimits.conf 


B. etcpam/limits.conf 


C. etcsecurity/limits.conf 
D. etcsecurity/pam/limits.conf 
E. usrlocal/limits.conf 


4. Which of the following tools might you use to check for open ports on a local 
computer? (Select three.) 


A. Nmap 

B. netstat 
C. lsof 

D. portmap 
E. services 


5. Which of the following commands will locate all of the program files on a 
computer on which the SUID bit is set? 


A. find / -type SUID 

B. find / -perm +4000 -type f 
C. find / -perm +SUID -type f 
D. find / -type +4000 

E. find / -suid 


6. The etcsudoers file on a computer includes the following line. What is its 
effect? 


%admin ALL=(ALL) ALL 


A. Members of the admin group may run all programs with root privileges by 
using sudo. 


B. Users in the admin user alias, defined earlier in the file, may run all 
programs with root privileges by using sudo. 


C. The admin user alias is defined to include all users on the system. 
D. The admin command alias is defined to include all commands. 


E. The user admin may run all programs on the computer as root by using 
sudo. 


7. Which command would you type, as root, to discover all the open network 


connections on a Linux computer? 
A. lsof -c a 
B. netstat -ap 
C. ifconfig etho 
D. nmap -sT localhost 
E. top -net 


8. A server/computer combination appears in both hosts.allow and 
hosts.deny. What's the result of this configuration when TCP wrappers runs? 


A. TCP wrappers refuses to run and logs an error in varlog/messages. 

B. The system's administrator is paged to decide whether to allow access. 
C. hosts.deny takes precedence; the client is denied access to the server. 
D. hosts.allow takes precedence; the client is granted access to the server. 


E. The client is granted access to the server if no other client is currently 
accessing it. 


9. When is the bind option of xinetd most useful? 
A. When you want to run two servers on one port 
B. When you want to specify computers by name rather than IP address 
C. When xinetd is running on a system with two network interfaces 
D. When resolving conflicts between different servers 
E. When xinetd manages a DNS server program 


10. You've discovered that the Waiter program (a network server) is running 
inappropriately on your computer. You therefore locate its startup script and 
shut it down by removing that script. How can you further reduce the risk that 
outsiders will abuse the Waiter program? (Select two.) 


A. By blocking the Waiter program's port using a firewall rule 


B. By reading the Waiter program's documentation to learn how to run it in 
stealth mode 


C. By tunneling the Waiter program's port through SSH 
D. By uninstalling the Waiter package 


E. By uninstalling any clients associated with Waiter from the server computer 


11. You want to use xinetd access controls to limit who may access a server 
that's launched via xinetd. Specifically, only users on the 192.168.7.0/24 
network block should be able to use that server. How may you do this? 


A. Enter hosts_allowed = 192.168.7.0/24 in the etcxinetd.conf 
configuration file for the server in question. 


B. Enter only_from = 192.168.7.0/24 in the etcxinetd.conf configuration 
file for the server in question. 


C. Enter server : 192.168.7., where server is the server's name, in the 
etchosts.allow file. 


D. Enter server : 192.168.7., where server is the server's name, in the 
etchosts.deny file. 


E. Type iptables -L 192.168.7.0 to enable only users of 192.168.7.0/24 to 
access the server. 


12. Of the following, which is the best password? 
A. Odysseus 
B. iA710cinMy~~~~~~ 
C. pickettomato 
D. Denver2Colorado 
E. 123456 


13. Which of the following types of attacks involves sending bogus email to lure 
unsuspecting individuals into divulging sensitive financial or other 
information? 


A. Phishing 

B. Script kiddies 
C. Spoofing 

D. Ensnaring 

E. Hacking 


14. Ordinary users report being unable to log onto a computer, but root has no 
problems doing so. What might you check to explain this situation? 


A. A misbehaving syslogd daemon 

B. A login process that's running as root 

C. The presence of an etcnologin file 

D. The presence of an SUID bit on binlogin 
E. Inappropriate use of shadow passwords 


15. Which servers might you consider retiring after activating an SSH server? 
(Select two.) 


A. SMTP 
B. Telnet 
C. FTP 
D. NTP 
E. Samba 


16. You find that the ssh_host_dsa_key file in etcssh has 0666 (- rw-rw-rw-) 
permissions. Your SSH server has been in operation for several months. 
Should you be concerned? 


A. Yes 

B. No 

C. Only if the ssh_host_dsa_key. pub file is also world-readable 
D. Only if you're launching SSH from a super server 

E. Only if you're using a laptop computer 


17. For best SSH server security, how should you set the Protocol option in 
etcssh/sshd_config? 


A. Protocol 1 
B. Protocol 2 
C. Protocol 1,2 
D. Protocol 2,1 
E. Protocol * 


18. Why is it unwise to allow root to log on directly using SSH? 


A. Disallowing direct root access means that the SSH server may be run by a 
non-root user, improving security. 


B. The root password should never be sent over a network connection; 
allowing root logins in this way is inviting disaster. 


C. SSH stores all login information, including passwords, in a publicly 
readable file. 


D. When logged on using SSH, root's commands can be easily intercepted and 
duplicated by undesirable elements. 


E. Somebody with the root password but no other password can then break 
into the computer. 


19. You've downloaded a GPG public key from a website into the file 
fredkey.pub. What must you do with this key to use it? 


A. Type inspect-gpg fredkey. pub. 
B. Type gpg --readkey fredkey. pub. 
C. Type import-gpg fredkey. pub. 

D. Type gpg --import fredkey.pub. 
E. Type gpg-import fredkey. pub. 


20. You want to send an encrypted message to an email correspondent. You both 
have GPG. What do you need to exchange before you can send your 
encrypted message? 


A. Your correspondent must obtain your GPG public key. 

B. Your correspondent must obtain your GPG private key. 
C. You must exchange private keys with your correspondent. 
D. You must obtain your correspondent's GPG private key. 


E. You must obtain your correspondent's GPG public key. 


Appendix Answers 


Chapter 1: Exploring Linux Command-Line 
Tools 


1. D. Any of these approaches will work, or at least might work. (You might 
err when performing any of them.) Option B or C is likely to be the most 
efficient approach; with a long filename to type, option A is likely to be 
tedious. 


2. E. The echo command is implemented internally to bash, although an 
external version is also available on most systems. The cat, less, tee, and 
sed commands are not implemented internally to bash, although they can 
be called from bash as external commands. 


3. E. The echo command echoes what follows to standard output, and $PROC is 
an environment variable. Thus, echo $PROC displays the value of the $PROC 
environment variable, meaning that it must have been set to the specified 
value by you, one of your configuration files, or a program you’ve run. 
Although many environment variables are set to particular values to convey 
information, $PROC isn’t a standard environment variable that might be 
associated with information described in options A, B, C, and D. 


4. A. The pwd command prints (to standard output) the name of the current 
working directory. The remaining options are simply incorrect, although 
option B describes the cd command, and various tools can be used to 
reformat wide text for display or printing in fewer columns, as in option C. 


5. A. The dot (.) character refers to the current working directory, and the 
slash (/) is a directory separator. Thus preceding a program name by ./ 
unambiguously identifies the intention to run the program that’s stored in 
the current directory. Option B will run the first instance of the program 
that’s found on the current path. Because paths often omit the current 
directory for security reasons, this option is likely to fail. The run command 
isn’t a standard Linux command, so option C is unlikely to do anything, 
much less what the question specifies. Option D would be correct except 
that it reverses the order of the two characters. The effect is to attempt to 
run the .myprog file in the root (/) directory. This file probably doesn’t 
exist, and even if it did, it’s not the file the question specifies should be run. 
Option E runs the first instance of myprog found on the path, and 
additionally it runs the program in the background. (Chapter 2 covers 


background execution in more detail.) 


6. E. By default, man uses the less pager to display information on most Linux 
systems, so option E is correct. Although an X-based version of man does 
exist (xman), the basic man doesn’t use a custom X-based application (option 
A), nor does it use Firefox (option B) or the vi editor (option D). The info 
command and man are competing documentation systems, so option C is 
incorrect. 


7. C. The > redirection operator stores a command’s standard output in a file, 
overwriting the contents of any existing file by the specified name, so 
option C is correct. Option A specifies the standard input redirection so that 
ifconfig will take the contents of file.txt as input. Option B is almost 
correct: the >> redirection operator redirects standard output, as requested, 
but it appends data to the specified file rather than overwriting it. Option D 
specifies a pipe; the output of ifconfig is sent through the file. txt 
program, if it exists. (Chances are it doesn’t, so you’d get a command not 
found error message.) Option E redirects standard error, rather than 
standard output, to file.txt and so is incorrect. 


8. C. The &> redirection operator sends both standard output and standard error 
to the specified file, as option C states. (The name of the file, input.txt, is 
intentionally deceptive, but the usage is still valid.) Option A mentions 
standard error but describes it as if it were an input stream, which it’s not; 
it’s an output stream. Option B mentions standard input, but the &> operator 
doesn’t affect standard input. Because only option C is correct, neither 
option D nor E can be correct. 


9. E. In principle, you can pipe together as many commands as you like. (In 
practice, of course, there will be limits based on input buffer size, memory, 
and so on, but these limits are far higher than the 2, 3, 4, or 16 commands 
specified in options A, B, C, and D.) 


10. B. The tee command sends its output both to standard output and to a 
named file. Thus, placing the tee command (with an output filename) after 
another command and a pipe will achieve the desired effect. Options A and 
D redirect gabby’s output to a file, which means you won’t be able to see 
the output and interact with it. Option C sends the contents of gabby- 
out.txt to gabby as input, which isn’t what’s desired, either. Option E 
attempts to run gabby-out.txt aS a program and use its output as 
command-line arguments to gabby, which is not what’s desired. 


11. C. The 2> redirection operator redirects standard error only, leaving 
standard output unaffected. Sending standard error to devnul1 gets rid of it. 
Thus option C is correct. Option A pipes the standard output of verbose 
through the quiet program, which isn’t a standard Linux program. Option 
B sends both standard output and standard error to devnu11, so you won’t 
be able to interact with the program as the question specifies you must be 
able to do. Option D redirects standard output only to the junk. txt file, so 
once again, interaction will be impossible—and yov’ll see the unwanted 
error messages on the screen. Option E’s quiet-mode program is fictitious 
(or at least nonstandard), so this option is incorrect. 


12. A. Option A correctly describes the difference between these two 
redirection operators. Option B is almost correct, but the >> operator will 
create a new file if one doesn’t already exist. The >> operator does not 
redirect standard error (as stated in option C) or standard input (as stated in 
option D). Both operators will create a new file if one doesn’t already exist, 
contrary to what option E states. 


13. C. The tail command displays the final 10 lines of a file, so option C is 
correct. (You can change the number of lines displayed with the -n option.) 
The uniq command (option A) removes duplicate lines from a list. The cut 
command (option B) echoes the specified characters or fields from an input 
text file. The wc command (option D) displays counts of the number of 
characters, words, and lines in a file. The fmt command (option E) is a 
plain-text formatter. 


14. A. The pr program takes a text file as input and adds formatting features 
intended for printing, such as a header and blank lines, to separate pages. 
The command also pipes the output through 1pr (which is a Linux printing 
command). Option A describes these effects and so is correct. Option B 
describes the effect of the cat program and so is incorrect. The conversion 
of tabs to spaces can be done by the expand program, so option C is 
incorrect. Although the specified command does print report .txt, error 
messages are not stored in the lpr file, so option D is incorrect. Because 
option A is correct, option E is incorrect. 


15. B, C, D. The n1 command numbers lines, so it does this task without any 
special options, and option B is correct. (Its options can fine-tune the way it 
numbers lines, though.) The cat command can also number lines via its -b 
and -n options; -b numbers non-blank lines, whereas -n numbers all lines 
(including blank lines). Thus options C and D are both correct. Neither the 


fmt command nor the od command will number the lines of the input file, 
so options A and E are both incorrect. 


16. D. The expand command will remove tab stops at every eight characters. 
With newly formatted data stored in data1.txt via the > redirection 
symbol, option D is the correct choice. 


The od command will not remove tabs. Therefore, option A is incorrect. 
Option B does remove the tabs; however, the resulting data file, data. txt, 
will contain duplicate data records (due to the >> redirection option), some 
with tabs and some without. Therefore, option B is incorrect. There is not a 
- -remove -tabs option on the fmt command, and thus option C is 
incorrect. The unexpand command does the opposite of the expand 
command, adding tab stops instead of removing them. Therefore, option E 
is incorrect. 


17. C. The sed utility can be used to “stream” text and change one value to 
another. In this case, the s option is used to replace dog with mutt, making 
option C correct. The syntax in option A is incorrect, and choices B and D 
are incorrect because grep doesn’t include the functionality needed to make 
the changes. Option E combines fmt, cut, and redirection in a way that 
simply won’t work to achieve the desired goal. 


18. B. The fmt command performs the desired task of shortening long lines by 
inserting carriage returns. It sends its results to standard output, so option B 
uses output redirection to save the results in a new file. The sed command 
of option A won’t accomplish anything useful; it only replaces the string 
Ctr1-M with the string NL. Although these strings are both sometimes used 
as abbreviations for carriage returns or new lines, the replacement of these 
literal strings isn’t what’s required. Option C creates an exact copy of the 
original file, with the long single-line paragraphs intact. Although option 
D’s pr command is a formatting tool, it won’t reformat individual 
paragraphs. It will also add headers that you probably don’t want. Option 
E’s grep command searches for text within files; it won’t reformat text 
files. 


19. A. The grep utility is used to find matching text within a file and print 
those lines. It accepts regular expressions, which means you can place in 
brackets the two characters that differ in the words for which you’re 
looking. Thus option A is correct. The syntax for sed, od, cat, and find 
wouldn’t perform the specified task, so options B through E are all 


incorrect. 


20. C. The bracket expression within the d[o-u]g regular expression in option 
C means that any three-character string beginning in d, ending in g, and 
with the middle character being between o and u will match. These results 
meet the question’s criteria. Option A’s dot matches any single character, 
so d.g matches all three words. The bracket expression [ou] in option B 
matches the characters o and u, but no other values. Since the question 
specifies that some other matches will be made, this option is incorrect. 
Option D’s di*g matches dig, diig, diiig, or any other word that begins 
with d, ends with g, and contains any number of i letters in between. Thus 
option D matches dig but not dog or dug as required. Option E, like option 
A, uses a dot to match any character, so it will actually match certain four- 
letter words but not dog or dug. 


Chapter 2: Managing Software 


1. D. Because they must be compiled prior to installation, source packages 
require more time to install than binary packages, contrary to option D’s 
assertion, thus making this option correct. The other options all describe 
advantages of source packages over binary packages. 


2. A. The two systems use different databases, which makes coordinating 
between them difficult. Therefore, using them both simultaneously is 
inadvisable, making option A correct. Package management systems don’t 
share information, but neither do their databases actively conflict, so option 
B is incorrect. Installing the same libraries using both systems would almost 
guarantee that the files served by both systems would conflict with one 
another, making option C incorrect. Actively using both RPM and Debian 
packages isn’t common on any distribution, although it’s possible with all 
of them, so option D is incorrect. The alien program converts between 
package formats. Although it requires that both systems be installed to 
convert between them, alien is not required to install both these systems, 
thus option E is incorrect. 


3. E. RPMs are usually portable across distributions, but occasionally they 
contain incompatibilities, so option E is correct. The package format and 
software licensing have nothing to do with one another, so option A is 
incorrect. There is no --convert-distrib parameter to rpm, so option B is 
incorrect. Although recompiling a source package can help work around 
incompatibilities, this step is not always required, so option C is incorrect. 
Binary packages can’t be rebuilt for another CPU architecture, so option D 
is incorrect; although source packages may be rebuilt for any supported 
architecture, provided the source code doesn’t rely on any CPU-specific 
features. 


4. B. The -i operation installs software, so option B is correct. (The -v and -h 
options cause a status display of the progress of the operation, which wasn’t 
mentioned in the option.) Uninstallation is performed by the -e operation, 
and rebuilding source RPMs is done by the - - rebuild operation (to either 
rpm or rpmbuild, depending on the RPM version), so options A and C are 
incorrect. Although the filename megaprog.rpm is missing several 
conventional RPM filename components, the rpm utility doesn’t use the 
filename as a package validity check, so option D is incorrect. Option E 


describes a package upgrade, which is handled by the -U operation, not -i 
as in the question, so option E is incorrect. 


5. A. The rpm2cpio program extracts data from an RPM file and converts it 
into a cpio archive that’s sent to standard output. Piping the results through 
cpio and using the -i and --make-directories options, as in option A, 
will extract those files to the current directory. Option B creates a cpio file 
called make-directories that contains the files from the RPM package. 
Option C will uninstall the package called myfonts.rpm (but not the 
myfonts package). The alien utility has no --to-extract target, so option 
D is invalid. The rpmbuild utility builds a source RPM into a binary RPM, 
making option E incorrect. 


6. E. An uppercase -P invokes the purge operation, which completely removes 
a package and its configuration files, so option E is correct. The -e 
parameter uninstalls a package for rpm, but not for dpkg, so option A is 
incorrect. The lowercase -p causes dpkg to print information about the 
package’s contents, so option B is incorrect. The -r parameter removes a 
package but leaves configuration files behind, so options C and D are both 
incorrect. (Option D also specifies a complete filename, which isn’t used 
for removing a package—you should specify only the shorter package 
name.) 


7. C. You can specify Debian package archive sites in etcapt/sources. list, 
and then you can type apt-get update and apt-get upgrade to update a 
Debian system quickly to the latest packages, so option C is correct. GUI 
package management tools for Debian and related distributions exist, but 
they aren’t apt-get, so option A is incorrect. The alien program can 
convert a tarball and install the converted package on a Debian system, but 
apt-get can’t do this, so option B is incorrect. dpkg and apt-get both 
come with all Debian-based distributions, so option D is incorrect. The 
dpkg program can install only Debian packages on Debian-based systems, 
but apt-get can work with both package systems, so option E is backward. 


8. E. The - -get-selections action to dpkg displays the names of all installed 
packages, making option E correct. There is no showall option to apt-get, 
so option A is incorrect. The showpkg subcommand to apt -cache displays 
information about a named package when used without a package name, as 
in option B, but it displays no data. The dpkg -r action removes a package, 
so option C would remove the package called allpkgs if it were installed. 
The dpkg -i action installs a package, so option D is incorrect—and that 


option doesn’t list a package name, which the -i action requires. 


9. D. The update option to apt-get causes retrieval of new information, as 
described in option D. This option is perfectly valid, contrary to option A’s 
assertion. The apt-get program doesn’t permit you to upload information 
to the Internet repositories, so option B is incorrect. Option C describes the 
effect of the upgrade or dist -upgrade options, not the update option. The 
upgrade or dist -upgrade options can upgrade APT itself, but update alone 
won’t do the job, so option E is incorrect. 


10. A, B. The Yum utility’s update and upgrade options are nearly identical in 
effect, and either can be used to upgrade an individual package, such as 
unzip, so options A and B are both correct. The primary command options 
to yum don’t use dashes, so options C and D are both incorrect. The check- 
update option to yum checks for the availability of updates, but it does not 
install them, so option E is incorrect. 


11. B. Yum uses files in the etcyum. repos.d directory to locate its 
repositories, so you can add to the repository list by adding files to this 
subdirectory, as option B specifies, typically either by installing an RPM or 
by adding a file manually. Option A describes a method of adding a 
repository to a computer that uses APT, not Yum. Option C’s add- 
repository subcommand is fictitious. Although the etcyum.conf file 
described in options D and E is real, it doesn’t store repository data. 


12. B. The etcld.so.conf file holds the global library path, so editing it is the 
preferred approach. You must then type ldconfig to have the system 
update its library path cache. Thus, option B is correct. Although you can 
add a directory to the library path by altering the LD_LIBRARY_PATH 
environment variable globally, as in option A, this approach isn’t the 
preferred one, so this option is incorrect. Option C simply won’t work. 
Option D also won’t work, although linking individual library files would 
work. This method isn’t the preferred one for adding a whole directory, 
though. The 1dd utility displays information on libraries used by executable 
files, so option E won’t have the desired effect. 


13. D. Programmers select libraries, not users nor system administrators. If you 
don’t like the widgets provided by one library, you have few options, and 
option D is correct. (Many widget sets do provide a great deal of 
configurability, though, so you may be able to work around the problem in 
other ways.) Options A, B, and E describe fictitious options to ldconfig, 


rpm, dpkg, and the kernel. Option C wouldn’t work; Qt-using programs 
would crash when they found GTK+ libraries in place of the Qt libraries 
they were expecting. 


14. D. The kill program accepts various signals in numeric or named form (9 
in this example) along with a process ID number (11287 in this example). 
Signal 9 corresponds to SIGKILL, which is an extreme way to kill processes 
that have run out of control, thus option D describes the effect of this 
command. Although you might use kill to kill network processes, you 
can’t pass kill a TCP port number and expect it to work, so option A is 
incorrect. The program also won’t display information about the number of 
processes that have been killed, making option B incorrect. To do as option 
C suggests, you’d need to tell kill to pass SIGHUP (signal 1), so the 
command would be kill -1 11287, and option C is incorrect. The kill 
program can’t change the priority of a process, so option E is incorrect. 


15. C, D. The top utility displays a dynamic list of processes ordered 
according to their CPU use along with additional system information, 
including load averages, so option C is correct. If you want only the load 
average at a specific moment, uptime (option D) may be better because it 
presents less extraneous information—it shows the current time, the time 
since the system was booted, the number of active users, and the load 
averages. Option A’s 1d command has nothing to do with displaying load 
averages. (It’s a programming tool that links together program modules into 
an executable program.) There are no standard Linux programs called load 
(option B) or la (option E). 


16. A. The --forest option to ps shows parent-child relationships by creating 
visual links between process names in the ps output, making option A 
correct. (Listing 2.4 shows this effect.) Options B and C are both valid ps 
commands, but neither creates the specified effect. Option D describes a 
fictitious ps option. Since options B, C, and D are incorrect, option E is also 
necessarily incorrect. 


17. A. CPU-intensive programs routinely consume 90 percent or more of 
available CPU time, but not all systems run such programs. Furthermore, 
some types of program bugs can create such CPU loads. Thus, option A is 
correct, and you must investigate the matter more. What is dfcomp? Is it 
designed as a CPU-intensive program? Is it consuming this much CPU time 
consistently, or was this a brief burst of activity? Options B, C, D, and E all 
jump to conclusions or present fictitious reasons for the behavior being 


normal or abnormal. 


18. E. The jobs command summarizes processes that were launched from your 
current shell. When no such processes are running, jobs returns nothing, so 
option E is correct. The jobs command doesn’t check or summarize CPU 
load, so option A is incorrect. The jobs command also doesn’t check for 
processes run from shells other than the current one, so option B is incorrect 
(processes running under your username could have been launched from 
another shell or from a GUI environment). There is no standard jobs shell 
in Linux, so option C is incorrect. Because the jobs output is limited to 
your own processes in the shell you’re running, a blank output does not 
indicate a crashed system, making option D incorrect. 


19. C, E. The nice command launches a program (crunch in this example) 
with increased or decreased priority. The default priority when none is 
specified is 10, and the nice -10 crunch command also sets the priority to 
10, so options C and E are equivalent. Option A isn’t a valid nice 
command because nice has no - -value option. Option B is a valid nice 
command, but it sets the priority to —10 rather than 10. Despite the 
similarity in the form of options C and D, option D is not a valid nice 
command, and so it is incorrect. (When passing a numeric value to nice, 
you must use a preceding dash, -, or -n.) 


20. D, E. Linux insulates users’ actions from one another, and this rule applies 
to renice; only root may modify the priority of other users’ processes, so 
option D is correct. Similarly, only root may increase the priority of a 
process in order to prevent users from setting their processes to maximum 
priority, thus stealing CPU time from others, so option E is correct. Option 
A correctly describes nice, but not renice. The whole point of renice is to 
be able to change the priorities of existing processes. Contrary to option B, 
renice doesn’t care about the shell from which renice or the target 
program was launched. Users may use renice to decrease their own 
processes’ priorities, contrary to option C. 


Chapter 3: Configuring Hardware 


1. B, C. IRQs 3 and 4 are common defaults for RS-232 serial ports, so options 
B and C are both correct. IRQ 1 is reserved for the keyboard, so option A is 
incorrect. IRQ 8 is reserved for use by the real-time clock, so option D is 
incorrect. Although IRQ 16 exists on modern systems, it didn’t exist on 
early x86 systems, and its purpose isn’t standardized. 


2. A. Modern firmware (BIOSs and EFIs) provides the means to disable many 
onboard devices, including sound hardware, in case you don’t want to use 
them, so option A is correct. Although the alsact1 utility mentioned in 
option B is real, it’s used to load or store sound card mixer settings, not to 
disable the sound hardware. The 1smod command mentioned in option C 
displays information about loaded kernel modules, but it doesn’t remove 
them or disable the hardware they use. Similarly, option D’s lspci displays 
information on PCI devices, but it can’t disable them. Contrary to option E, 
onboard sound hardware can usually be disabled. 


3. E. The udev software creates and manages a dynamic /dev directory tree, 
adding entries to that directory for devices that exist on the target system, so 
option E is correct. The udev software has nothing to do with software 
development (option A). It doesn’t unload drivers (option B) or load drivers 
(option C), although it does respond to the loading of drivers by creating 
appropriate entries in /dev. It also doesn’t store BIOS configuration options 
in a file (option D). 


4. E. SATA disks are usually handled by Linux’s SCSI subsystem and so are 
referred to as devsdx. However, some drivers handle these disks as if they 
were PATA disks and so refer to them as devhdx. Thus, option E is correct, 
and both options A and C are incorrect. The devmapper directory holds 
device files related to LVM and RAID configurations, not disk partition 
identifiers, so option B is incorrect. Option D (C:) is how Windows would 
likely refer to the first partition on the disk, but Linux doesn’t use this style 
of disk identifier. 


5. A, C, D. There are no files called procioaddresses or prochardware, so 
options B and E are both incorrect. All the other files listed contain useful 
information; procioports holds information about I/O ports, procdma holds 
information about DMA port usage, and procinterrupts holds information 
about IRQs. 


6. B. Logical partitions are numbered 5 and up, and they reside in an extended 
partition with a number between 1 and 4. Therefore, one of the first two 
partitions must be an extended partition that houses partitions 5 and 6, 
making option B correct. Because one of the first two partitions is an 
extended partition, the other must be a primary partition, and there can be 
no more of either type of partition. This makes option A incorrect. Gaps in 
the range of partitions 1—4 are normal in MBR disks, contrary to option C. 
Because logical partitions are numbered starting at 5, their numbers won’t 
change if devsda3 is subsequently added, so option D is incorrect. On MBR 
disks, partitions 1—4 must be primary or extended partitions; logical 
partitions are numbered 5 and up. Thus option E is incorrect. 


7. E. The etcfstab file contains the mapping of partitions to mount points, so 
/etc must be an ordinary directory on the root partition, not on a separate 
partition, making option E correct. Although option A’s statement that the 
system won’t boot is correct, the reason is not; /home holds user files, not 
critical system files. Options B and C describe restrictions that don’t exist. 
Option D would be correct if /etc were not a separate partition. 


8. D. The /home directory (option D) is frequently placed on its own partition 
in order to isolate it from the rest of the system and sometimes to enable use 
of a particular filesystem or filesystem mount options. The /bin and /sbin 
directories (options A and B) should never be split off from the root (/) 
filesystem because they contain critical executable files that must be 
accessible in order to do the most basic work, including mounting 
filesystems. The /mnt directory (option C) often contains subdirectories 
used for mounting removable media, or it may be used for this purpose 
itself. It’s seldom used to access hard disk partitions directly, although it 
can be used for this purpose. The /dev directory (option E) usually 
corresponds to a virtual filesystem, which holds pseudo-files but is not 
stored on a disk partition. 


9. A. The OxOf partition type code is one of two common partition type codes 
for an extended partition. (The other is 0x05.) The 0x82 code refers to a 
Linux swap partition, and 0x83 denotes a Linux filesystem partition. Thus, 
it appears that this disk holds Linux partitions, making option A correct. 
Windows, FreeBSD, and Mac OS X all use other partition type codes for 
their partitions, so options B, C, and E are all incorrect. (Mac OS X is also 
rarely installed to MBR disks.) Partitions exist, in part, to enable different 
OSs to store their data side by side on the same disk, so mixing several 


partition types (even for different OSs) on one disk does not indicate disk 
corruption, making option D incorrect. 


10. C. Linux’s fdisk doesn’t write changes to disk until you exit the program 
by typing w. Typing q exits without writing those changes, so typing q in 
this situation will avert disaster, making option C correct. Typing w (option 
B) would be precisely the wrong thing to do. Because fdisk doesn’t write 
changes until you type w, the damage is not yet done, contrary to option A. 
Typing u (option D) or t (option E) would do nothing useful because those 
aren’t undo commands. 


11. E. The mkfs command creates a new filesystem, overwriting any existing 
data and therefore making existing files inaccessible, as stated in option E. 
This command doesn’t set the partition type code in the partition table, so 
option A is incorrect. The mkfs command is destructive, contrary to option 
B. The -t ext2 option tells mkfs to create an ext2 filesystem; it’s a 
perfectly valid option, so option C is incorrect. Although mkfs could 
(destructively) convert ext2fs to ext4fs, the -t ext2 option clearly indicates 
that an ext2 filesystem is being created, so option D is incorrect. 


12. B. Although they have similar names and purposes, Linux’s fdisk isn’t 
modeled after Windows’s FDISK, so option B is correct and option A is not. 
Windows’ FDISK does not have GUI controls, contrary to option C. Linux’s 
fdisk does not format floppy disks, contrary to option D. Both programs 
manage MBR disks, contrary to option E. 


13. E. Swap partitions aren’t mounted in the same way as filesystems, so they 
have no associated mount points, making option E correct. 


14. C. The -t option is used to tell fsck what filesystem to use, so option C is 
correct. (If this option isn’t used, fsck determines the filesystem type 
automatically.) The -A option (option A) causes fsck to check all of the 
filesystems marked to be checked in etcfstab. The -N option (option B) 
tells fsck to take no action and to display what it would normally do 
without doing it. The -c option (option D) displays a text-mode progress 
indicator of the check process. The -f option (option E) is fictitious. 


15. A. A default use of df reports the percentage of disk space used (option D) 
and the mount point for each filesystem (option E). The number of inodes 
(option B) and filesystem types (option C) can both be obtained by passing 
parameters to df. This utility does not report how long a filesystem has 
been mounted (option A), so that option is correct. 


16. D. The journal of a journaling filesystem records pending operations, 
resulting in quicker disk checks after an uncontrolled shutdown, so option 
D is correct. Contrary to option A, journaling filesystems are, as a class, 
newer than non-journaling filesystems; in fact, the journaling ext3fs is built 
upon the non-journaling ext2fs. Although disk checks are quicker with 
journaling filesystems than with non-journaling filesystems, journaling 
filesystems do have fsck utilities, and these may still need to be run from 
time to time, so option B is incorrect. All Linux-native filesystems support 
Linux ownership and permissions; this isn’t an advantage of journaling 
filesystems, contrary to option C. The journal of a journaling filesystem 
doesn’t provide an unlimited “undo” feature, so option E is incorrect. 


17. E. When typed without a filesystem type specification, mount attempts to 
auto-detect the filesystem type. If the media contains any of the specified 
filesystems, it should be detected and the disk mounted, so option E is 
correct. 


18. B. The etcfstab file consists of lines that contain the device identifier, the 
mount point, the filesystem type code, filesystem mount options, the dump 
flag, and the filesystem check frequency, in that order. Option B provides 
this information in the correct order, and so it will work. Option A reverses 
the second and third fields, but is otherwise correct. Options C, D, and E all 
scramble the order of the first three fields and also specify the noauto 
mount option, which causes the filesystem not to mount automatically at 
boot time. 


19. A, B, C. The user, users, and owner options in etcfstab all enable 
ordinary users to mount a filesystem, but with slightly different 
implications: user enables anybody to mount a filesystem—and only that 
user May unmount it; users enables anybody to mount a filesystem, and 
anybody may unmount it; and owner enables only the owner of the mount 
point to mount or unmount a filesystem. Thus, options A, B, and C are all 
correct. The owners parameter of option D doesn’t exist. The uid=1000 
parameter of option E tells Linux to set the ownership of files to UID 1000 
on filesystems that lack Linux permissions features. Although this might be 
desirable for some disks, it doesn’t enable the user with UID 1000 to mount 
the disk, so option E is incorrect. 


20. A. Option A correctly describes the safe procedure for removing a 
removable medium that lacks a locking mechanism from a Linux computer. 
(Instead of typing umount mediausb, you could type umount devsdb1; in 


this context, the two commands are equivalent.) Option B reverses the order 
of operations; the umount command must be typed before you physically 
remove the flash drive. Option C also has it backward; the sync command 
would need to be issued before removing the drive. (The sync command 
can prevent damage when removing disks, but it isn’t a complete substitute 
for umount.) There is no standard usbdrive-remove command in Linux, 
and if you were to write a script that calls umount and call it usbdrive- 
remove, pulling the flash drive quickly, as option D describes, would be 
exactly the wrong thing to do. The fsck command of option E checks a 
filesystem for errors. It’s not necessary to do this before removing a disk, 
and it won’t unmount the disk, so option E is incorrect. 


Chapter 4: Managing Files 


1. B. The touch utility updates a file’s time stamps, as option B specifies. (If 
the specified file doesn’t exist, touch creates an empty file.) You can’t 
move files with touch; that’s the job of the mv command, so option A is 
incorrect. Various tools can convert end-of-line formats, but touch is not 
one of them, so option C is incorrect. Testing the validity of disk structures, 
as in option D, is normally done on a whole-filesystem basis with fsck and 
related tools; touch can’t do this job. You can write cached data to disk for 
a whole filesystem by unmounting it or by using sync, but touch can’t do 
this, so option E is incorrect. 


2. A, D. The -s and --symbolic options to 1n are equivalent, and both create a 
symbolic (aka soft) link. Thus, options A and D are both correct. Options B, 
C, and E don’t exist. 


3. A. The -1 parameter produces a long listing, including file sizes. The -a 
parameter produces a listing of all files in a directory, including the dot 
files. Combining the two produces the desired information (along with 
information about other files), so option A is correct. The -p, -R, -d, and -F 
options don’t have the specified effects, so the remaining options are all 
incorrect. 


4. D. When moving from one partition or disk to another, mv must necessarily 
read and copy the file and then delete the original if that copy was 
successful, as stated in option D. If both filesystems support ownership and 
permissions, they’ ll be preserved; mv doesn’t need an explicit - -preserve 
option to do this, and this preservation does not rely on having exactly the 
same filesystem types. Thus, option A is incorrect. Although mv doesn’t 
physically rewrite data when moving within a single low-level filesystem, 
this approach can’t work when you’re copying to a separate low-level 
filesystem (such as from a hard disk to a USB flash drive); if the data isn’t 
written to the new location, it won’t be accessible should the disk be 
inserted in another computer. Thus, option B is incorrect. Although not all 
filesystems support ownership and permissions, many do, and these 
attributes are preserved when moving files between them, so option C is 
incorrect. Although FAT is a common choice on removable media because 
of its excellent cross-platform support, other filesystems will work on such 
disks, so option E is incorrect. 


5. A, B. If you try to create a directory inside a directory that doesn’t exist, 
mkdir responds with a No such file or directory error. The --parents 
parameter tells mkdir to create all necessary parent directories 
automatically in such situations, so option A is correct. You can also 
manually do this by creating each necessary directory separately, so option 
B is also correct. (It’s possible that mkdir one wouldn’t be necessary in this 
example if the directory one already existed. No harm will come from 
trying to create a directory that already exists, although mkdir will return a 
File exists error.) Typing touch binmkdir, as option C suggests, will 
likely result in an error message if typed as a normal user and won’t help if 
typed as root, so this option is incorrect. Clearing away existing directories 
in the one/two/three tree won’t help, so option D is incorrect. Option E’s 
mktree command is fictitious. 


6. D, E. The cpio and tar programs are common Linux archive-creation 
utilities, so options D and E are both correct. The restore command 
restores (but does not back up) data; its backup counterpart command is 
dump. Thus, option A is incorrect. The vi command launches a text editor; 
it’s not used to create archives, so option B is incorrect. There is no 
standard tape command in Linux, so option C is incorrect. 


7. E. With the tar utility, the --list (t) command is used to read the archive 
and display its contents. The --verbose (v) option creates a verbose file 
listing, and --file (f) specifies the filename—data79. tar in this case. 
Option E uses all of these features. Options A, B, C, and D all substitute 
other commands for --list, which is required by the question. 


8. A. Symbolic links can point across filesystems, so creating a symbolic link 
from one filesystem (in which your home directory resides) to another (on 
the DVD) isn’t a problem, making option A correct. Hard links, as in 
options B, C, and D, are restricted to a single filesystem and so won’t work 
for the described purpose. Because symbolic links will work as described, 
option E is incorrect. 


9. E. Option E is the correct command. Typing chown ralph: tony 
somefile.txt, as in option A, sets the owner of the file to ralph and the 
group to tony. The chmod command used in options B and D is used to 
change file permissions, not ownership. Option C reverses the order of the 
filename and the owner. 


10. C, E. The d character that leads the mode indicates that the file is actually a 


directory (option C), and the r symbol in the r-x triplet at the end of the 
symbolic mode indicates that all users of the system have read access to the 
directory (option E). Leading 1 characters, which this mode lacks, denote a 
symbolic link, so option A is incorrect. Although the x symbols usually 
denote executable program files, as specified in option B, in the case of 
directories this permission bit indicates that the directory’s contents may be 
searched; executing a directory is meaningless. SUID bits are indicated by 
an s character in place of the owner’s execute bit position in the symbolic 
mode. Since this position holds an x in this example, option D is incorrect. 


11. C. The set user ID (SUID) bit enables programs to run as the program’s 
owner rather than as the user who ran them. This makes SUID root 
programs risky, so setting the SUID bit on root-owned programs should be 
done only when it’s required for the program’s normal functioning, as 
stated in option C. This should certainly not be done for all programs 
because the SUID bit is not required of all executable programs, as option 
A asserts. Although the SUID root configuration does enable programs to 
access device files, the device files’ permissions can be modified to give 
programs access to those files, if this is required, so option B is incorrect. 
Although SUID root programs are a security risk, as stated in option D, 
they’re a necessary risk for a few programs, so option D goes too far. Many 
program files that should not be SUID root are owned by root, so option E 
is incorrect. 


12. E. Using symbolic modes, the o+r option adds read (r) permissions to the 
world (o). Thus, option E is correct. Option A sets the mode to rwxr----x, 
which is a bit odd and doesn’t provide world read access to the file, 
although it does provide world execute access. Option B sets the mode to 
rw-r----- , which gives the world no access whatsoever to the file. Option 
C adds read access to the file for the owner (u) if the owner doesn’t already 
have this access; it doesn’t affect the world permissions. Option D removes 
read access for all users, so it’s incorrect. 


13. D. Files start with a 666 permission bit octal number setting. Depending 
upon the umask setting, permission bits may be removed, but not added. 
Option D, 027, removes write permissions for the group and all world 
permissions. (Files normally don’t have execute permissions set, but 
explicitly removing write permissions when removing read permissions 
ensures reasonable behavior for directories.) Therefore, Option D is correct. 
Option A, 640, is the octal equivalent of the desired rw-r----- permissions, 


but the umask sets the bits that are to be removed from permissions, not 
those that are to be set. Option B, 210, would remove write permission for 
the owner, but it wouldn’t remove write permission for the group, which is 
incorrect. This would also leave all world permissions open. Option C, 022, 
wouldn’t remove world read permission. Option E, 138, is an invalid umask 
because all the digits in the umask must be between 0 and 7. 


14. E. Using quotas requires kernel support, the usrquota or grpquota (for 
user or group quotas) filesystem mount option, and activation via the 
quotaon command (which often appears in system startup scripts). Thus, 
option E is correct. Option A suggests that quotaon is not necessary, which 
is incorrect. Option B’s statement that grpquota is invalid is incorrect. 
Option C’s statement that these options disable quota support is backward. 
The usrquota and grpquota options are both valid, so option D is incorrect. 


15. B. The repquota utility is used to summarize the quota information about 
the filesystem. When used with the -a option, it shows this information for 
all filesystems, so option B is correct. This command won’t return useful 
information when typed alone, though, so option A is incorrect. The 
quotacheck utility checks quota information about a disk and writes 
corrections, so options C and D are both incorrect. The edquota utility 
enables you to edit quota information. It doesn’t summarize quota 
information, and -a isn’t a valid option to edquota. Thus, option E is 
incorrect. 


16. D. The /opt directory tree exists to hold programs that aren’t a standard 
part of a Linux distribution, such as commercial programs. These programs 
should install in their own directories under /opt; these directories usually 
have bin subdirectories of their own, although this isn’t required. Thus, 
option D is correct (that is, it’s a plausible possibility). The usrsbin 
directory holds programs that are normally run only by the system 
administrator, so it’s not a likely location, making option A incorrect. The 
etcX11 directory holds X-related configuration files; so it’s very unlikely 
that WonderCalc will be housed there, making option B incorrect. The 
/boot directory holds critical system boot files, so option C is incorrect. 
The /sbin directory, like usrsbin, is an unlikely location for user files, so 
option E is incorrect. (Furthermore, /sbin seldom contains subdirectories.) 


17. A. The find utility (option A) operates by searching all files in a directory 
tree, and so it’s likely to take a long time to search all of a computer’s 
directories. The locate program uses a precompiled database, whereis 


searches a limited set of directories, and type searches the shell’s path and 
built-in commands, so these commands will take less time. Thus, options B, 
C, D, and E are all incorrect. 


18. C. The type command identifies a command, as executed by the shell, as 
being a built-in shell command, a shell alias, or an external command, 
whereas the whereis command helps find the location of external command 
files, thus option C is correct. Neither type nor whereis identifies the CPU 
architecture of a program file, can locate commands based on intended 
purpose, complete an incompletely typed command, or identify a command 
as a binary or a script; thus, the remaining options are all incorrect. 


19. B. The find command includes the ability to search by username using the 
-user name option, where name is the username; thus option B is correct. 
The -uid option to find can also locate files owned by a user, but it takes a 
numeric user ID (UID) as an argument, so option A isn’t quite correct. The 
locate command provides no ability to search by user, so options C and D 
are incorrect. Although option E is a valid find command, it finds all of the 
files under /home with a filename of karen, not all files owned by the user 
karen, so this option is incorrect. 


20. D. The which program searches the path just as bash does, but it prints the 
path to the first executable program it finds on the path. Thus option D is 
correct. The which program doesn’t conduct an exhaustive search of the 
system, so there could be many more files called man on the system, 
contrary to option A. System package tools and which aren’t closely 
related; option B is incorrect. Although /usrbinman would be run when the 
user whose which output matches that in the question types man, this may 
not be true of others because the path can vary from one user to another, 
thus option C is incorrect. The which program doesn’t reveal file ownership 
information, so option E is incorrect. 


Chapter 5: Booting Linux and Editing Files 


1. C. The Master Boot Record (MBR) can contain a boot loader that is up to 
446 bytes in size, so option C is correct. If more space is required, the boot 
loader must load a secondary boot loader. Although the boot loader is 
loaded into RAM (option A), it’s not stored there permanently because 
RAM is volatile storage. Both devboot and devkmem (options B and D) are 
references to files on Linux filesystems; they’re only available after the 
system starts and lots of other boot processes have occurred. The swap 
partition (option E) is used as an adjunct to RAM; the BIOS won’t look 
there for a boot loader. 


2. C. Runlevel 1 is single-user mode, and adding the digit 1 to the kernel’s 
options line in a boot loader will launch the system in this runlevel, so 
option C is correct. Options A and B both present invalid kernel options and 
so are incorrect. Although the telinit command specified in options D and 
E will change the runlevel once the computer is running and runlevel 1 is a 
single-user mode, these commands are not passed to the kernel via a boot 
loader, so these options are both incorrect. 


3. D. The kernel ring buffer, which can be viewed by typing dmesg (piping this 
through less is a good supplement), contains messages from the kernel, 
including those from hardware drivers. These messages may provide a clue 
about why the disk didn’t appear, thus option D is correct. The 
varlog/diskerror file (option A) is fictitious, as is mmtdisks (option B). 
The etcinittab file (option C) doesn’t directly control disk access, and so 
it is unlikely to provide useful information. The files specified in option E 
are GRUB Legacy and GRUB 2 configuration files, which don’t contain 
information that could explain why a disk isn’t responding. 


4. B. Ordinarily, Linux runs init (option B) as the first program; init then 
runs, via various scripts, other programs. The dmesg program (option A) is a 
user diagnostic and information tool used to access the kernel ring buffer; 
it’s not part of the startup process. The startup program (option C) is 
fictitious. The rc program (option D) is a script that some versions of init 
call, typically indirectly, during the startup sequence, but it’s not the first 
program that the kernel runs. LILO is an older boot loader for Linux on 
BIOS systems, and lilo (option E) is the command that installs this boot 
loader to the MBR. Since boot loaders run before the kernel loads, this 


option is incorrect. 


5. D. Option D is the correct GRUB 2 configuration file. Option A is a 
fictitious file; it doesn’t exist. Although some of GRUB 2’s boot loader 
code may be written to the MBR, as implied by option B, this isn’t the 
location of the program’s configuration file. Options C and D are both 
possible names for the GRUB Legacy configuration file, but that name is 
not shared by GRUB 2. 


6. A. The initrd keyword identifies an initial RAM disk file in the GRUB 2 
configuration file, and a space separates this keyword from the filename. 
(Several variants on this syntax are possible.) Option B adds an equal sign 
(=), which renders the syntax incorrect. Options C, D, and E use the 
incorrect initramfs and ramdisk keywords instead of initrd. 


7. D. You use grub-instal1 to install the GRUB Legacy boot loader code into 
an MBR or boot sector. When using grub-install, you specify the boot 
sector on the command line. The MBR is the first sector on a hard drive, so 
you give it the Linux device identifier for the entire hard disk, devsda. 
Hence, option D is correct. Option A specifies using the grub utility, which 
is an interactive tool, and the device identifier shown in option A is a 
GRUB-style identifier for what would probably be the devsda3 partition in 
Linux. Option B is almost correct, but it installs GRUB to the devsda1 
partition’s boot sector rather than to the hard disk’s MBR. Option C is the 
command to install LILO to the MBR rather than to install GRUB. Option 
E contains the same error as option B, and it also uses the fictitious grub- 
legacy command. 


8. B. The root keyword in a GRUB Legacy configuration file tells the boot 
loader where to look for files, including its own configuration files, kernel 
files, and so on. Because GRUB Legacy numbers both disks and partitions 
starting from 0, (hd1,5) refers to the sixth partition on the second disk, as 
option B specifies. Option A is incorrect because you pass the Linux root 
partition to the kernel on the kernel line, not via the GRUB root keyword. 
Options A, C, and E all misinterpret the GRUB numbering scheme. The 
GRUB installation location is specified on the grub-install command 
line, so options D and E are incorrect, and devhdi,5 isn’t a standard Linux 
device file, which also makes option D incorrect. 


9. B. The initdefault action specifies the default runlevel, so option B is 
correct. The remaining options are all taken from actual etcinittab files 


but don’t have the specified meaning. 


10. A, B, E. Runlevel 0 (option A) is the reserved runlevel for halting the 
system. Runlevel 1 (option B) is reserved for single-user mode. Runlevel 6 
(option E) is reserved for rebooting. Runlevel 2 (option C) is the default 
runlevel on Debian and most distributions derived from it, but it does none 
of the things described in the question. Runlevel 5 (option D) is a regular, 
user-configurable runlevel, which isn’t normally used for the things 
described in the question. (Many systems use it for a regular boot with a 
GUI login prompt.) 


11. B, C. The first number in the runlevel output is the previous runlevel (the 
letter N is used to indicate that the system hasn’t changed runlevels since 
booting). The second number is the current runlevel. Hence, options B and 
C are both correct, while options A and D are both incorrect. The runlevel 
changes very quickly, and the runlevel utility doesn’t provide a code to 
indicate that the runlevel is in the process of being changed, so option E is 
incorrect. 


12. A. The -c option to shutdown cancels a previously scheduled shutdown, as 
stated in option A. Options B and C describe the effects of the -r and -h 
options to shutdown, respectively. No shutdown option asks for 
confirmation before taking action, although you can delay a shutdown by 
specifying a shutdown time in the future, so option D is incorrect. No 
shutdown option closes open windows in X, except as a consequence of 
shutting down, so option E is incorrect. 


13. B. The journalct1 program displays the systemd log file, so option A is 
incorrect. Options C and D are commands used for the SysV initialization 
process, and Option E is the systemd process command. Option B, 
systemct1, is the correct answer. 


14. B. The telinit command is used to change runlevels; when it’s passed the 
1 parameter, as in option B, telinit changes to runlevel 1, which is single- 
user mode. The runlevel command (option A) displays the current 
runlevel but doesn’t change runlevels. Although telinit can be used to 
shut down or reboot the computer, the shutdown command (option C) can’t 
be used to change runlevels except to runlevel 0 or 6. There is no standard 
single-user command (option D). The halt command (option E), like 
shutdown, can’t be used to change to single-user mode. 


15. A. The isolate command for the systemct1 program allows you to 


change the target of the system. The rescue target specifies single-user 
mode. Option B changes the system to the default target, which may or may 
not be single-user mode. The journalct1 program in Option C displays the 
systemd log files. The systemd program isn’t used to change targets (Option 
D), and the start command only starts a single unit, not a target (Option 
E). 


16. A. In vi, dd is the command-mode command that deletes lines. Preceding 
this command by a number deletes that number of lines. Thus option A is 
correct. Although yy works similarly, it copies (yanks) text rather than 
deleting it, so option B is incorrect. Option C works in many more-modern 
text editors, but not in vi. Option D works in Emacs and similar text editors, 
but not in vi. Option E works in many GUI text editors, but not in vi. 


17. D. The :q! vi command does as option D states. Options A and E are both 
simply incorrect. Option B would be correct if this command was typed 
while in vi’s insert mode, but the question specifies that command mode is 
in use. To achieve option C, the command would be :wq, not :q!. 


18. E. Vi is included on Linux emergency systems, embedded systems, and 
other systems where space is at a premium because its executable is tiny. 
Emacs is, in contrast, a behemoth. Thus option E is correct. Contrary to 
option A, vi isn’t an X-based program (although X-based vi variants are 
available); Emacs can be used in text mode or with X. Extended Binary 
Coded Decimal Interchange Code (EBCDIC) is an obscure 8-bit character 
encoding system used on some very old mainframe OSs. When run on 
Linux, vi doesn’t use EBCDIC; furthermore, EBCDIC offers few or no 
advantages over the American Standard Code for Information Interchange 
(ASCII). Thus option B is incorrect. Vi’s modes, referred to in option C, 
have nothing to do with non-English language support. Option D is 
backward; it’s Emacs that includes a web browser, email client, and other 
add-ons. 


19. A, B, C. Typing R (option A) in command mode enters insert mode with 
the system configured to overwrite existing text. Typing i or a (options B 
and C, respectively) enters insert mode with the system configured to insert 
text. (The i and a commands differ in how they place the cursor; a 
advances one space.) Typing : (option D) in command mode enters ex 
mode (you typically type the ex-mode command on the same command line 
immediately after the colon). Pressing the Esc key (option E) returns vi to 
command mode from insert mode. 


20. B. The Esc key exits vi’s insert mode, as option B specifies. Typing a tilde 
(~) inserts that character into the file, so option A is incorrect. The Ctrl+X, 
Ctrl+C key combination exits from Emacs, but it’s not a defined vi key 
sequence, so option C is incorrect. The F10 key and the Shift+Insert key 
combination also aren’t defined in vi, so options D and E are both incorrect. 


Chapter 6: Configuring the X Window System, 
Localization, and Printing 


1. A. On most Linux systems, some runlevels don’t run X by default, so using 
one of them along with the startx program (which starts X running) can be 
an effective way to test changes to an X configuration quickly, making 
option A correct. The telinit program changes runlevels, which is a 
lengthy process compared to using startx, so option B is incorrect. 
Unplugging the computer to avoid the shutdown process is self-defeating 
because you’ll have to suffer through a long startup (if you use a non- 
journaling filesystem), and it can also result in data loss, thus option C is 
incorrect. The startx utility doesn’t check the veracity of an X 
configuration file; it starts X running from a text-mode login, making 
option D incorrect. Reconfiguring an X server does not normally require 


network access; the X server runs on the computer at which you sit. Thus 
option E is incorrect. 


2. D. The xF86Config and xorg.conf file design enables you to define variants 
or multiple components and easily combine or recombine them as 
necessary, using the structure specified in option D. Options A, B, and C all 
describe fictitious structures. Option E is incorrect because the X.org-X11 


and XFree86 configuration files use a text-mode structure, not a binary 
structure. 


3. C. The vertical refresh rate range includes a maximum value, but that value 
may be reduced when the resolution and vertical refresh rate would demand 
a higher horizontal refresh rate than the monitor can handle. Thus, option C 
is correct. Since the resolution affects the maximum refresh rate, option A 
is incorrect. The color depth is irrelevant to resolution and refresh rate 
calculations, so option B is incorrect. The computations shown in options D 
and E are bogus, making these options incorrect. 


4. E. Option E describes the correct location for this option. The ServerLayout 
section (referenced in option A) combines all of the other options together 
but doesn’t set the resolution. The Modeline option in the Monitor section 
(as described in option B) defines one possible resolution, but there may be 
several Modeline entries defining many resolutions, and there’s no 
guarantee that any of them will be used. The Modeline option doesn’t exist 
in the Device section (as suggested by option C), nor is that section where 


the resolution is set. There is no DefaultResolution section (as referenced 
in option D). 


5. B. By maintaining fonts on one font server and pointing other X servers to 
that font server, you can reduce the administrative cost of maintaining the 
fonts on all of the systems, so option B is correct. Font servers don’t 
produce faster font displays than X’s local font handling; if anything, the 
opposite is true. Thus, option A is incorrect. XFree86 4.x supports 
TrueType fonts directly, so option C is incorrect. Converting a bitmapped 
display into ASCII text is a function of optical character recognition (OCR) 
software, not a font server, so option D is incorrect. Neither X core fonts 
nor a font server handles font smoothing; for that, you need Xft. Thus, 
option E is incorrect. 


6. C, E. XDMCP servers are typically launched either from a system startup 
script or by init (as specified in etcinittab), as described in options C 
and E. The XDMCP server then starts X. The Start folder mentioned in 
option A is a Windows construct, not a Linux construct. The ~/.xinitrc 
script mentioned in option B is an X login script used when starting X from 
the command line via startx; it’s not used to start X automatically when 
the system boots. A boot manager, as described in option D, launches the 
kernel; it doesn’t directly start X, so option D is incorrect. 


7. E. The XDM greeting is a resource set in the etcX11/xdm/xXresources file, 
so option E is correct. XDM doesn’t offer many options on its main screen 
and certainly not one to change its greeting, as described in option A. The 
kernel doesn’t directly handle the login process, nor does it pass options 
directly to XDM, so option B is incorrect. Although the xorg.conf file 
mentioned in option C is real, this file provides no XDM configuration 
options because XDM is a separate program from the X server. There is no 
standard xdmconfig program, as mentioned in option D. 


8. C. KDM and GDM add many features, one of which is a menu that enables 
users to select their desktop environment or window manager when they 
log in rather than specifying it in a configuration file, as option C states. 
Option A describes one of the advantages of the Secure Shell (SSH) as a 
remote-access protocol. Option B describes a feature common to all three 
XDMCP servers. Option D describes the way both KDM and XDM 
function; GDM is the one that presents username and password fields in 
series rather than simultaneously. Although a failure of X to start usually 
results in a fallback to a text-mode login, this feature is not provided by the 


XDMCP server, so option E is incorrect. 


9. The xhost command controls various aspects of the local X server, 
including the remote computers from which it will accept connections, 
making option A correct. Option B sets the DISPLAY environment variable, 
which doesn’t directly affect the X server (it does tell X clients which X 
server to use). Option C initiates a text-mode remote login session with 
penguin.example.com. Option D’s xaccess is a fictitious program. 
Although logging into penguin.example.com via ssh may also initiate an X 
tunnel, this isn’t guaranteed, and such a tunnel doesn’t cause the local X 
server to accept direct connections from the remote computer, so option E 
is incorrect. 


10. A. As stated in option A, GNOME, KDE, and other user programs often 
override the keyboard repeat settings in the X configuration file. Option B 
has it almost backward; most Linux distributions have abandoned XFree86, 
and therefore its XF86Config file, in favor of X.org-X11 and its xorg.conf 
file. Option C is pure fiction; xorg.conf settings apply to all varieties of 
keyboards, and there is no standard usbkbrate program. Although some 
keyboards do have hardware switches, they don’t affect X’s ability to 
control the keyboard repeat rate, contrary to option D. Although you can set 
a keyboard’s nationality in xorg.conf, this option is independent of the 
keyboard repeat rate settings, so option E is incorrect. 


11. C, E. The Orca and Emacspeak programs both provide text-to-speech 
conversion facilities, so options C and E are both correct. Braille is a form 
of writing that uses bumps or holes in a surface that can be felt by the 
reader. Although Linux supports Braille output devices, the question 
specifies computer-generated speech, which Braille is not, so option B is 
incorrect. SoX (option A) is an audio format converter, but it won’t convert 
from text to speech. The talk program (option D) is an early Unix online 
text-mode “chat” program, but it has no built-in speech synthesis 
capabilities. 


12. B, E. Time zones are determined by the etclocaltime file, so replacing 
that one with the correct file (a selection is stored in usrshare/zoneinfo) 
will fix the problem, making option B correct. (You may also need to edit 
etctimezone or some other file to keep automatic utilities from becoming 
confused.) Utilities such as tzselect will make these changes for you after 
prompting you for your location, so option E is also correct. The hwclock 
program mentioned in option A reads and writes data from the system’s 


hardware clock. Although it relies on time zone data, it can’t adjust your 
system’s time zone itself. There is no standard etctzconfig file, although 
the tzconfig program, like tzselect, can help you set the time zone. Thus, 
option C is incorrect. The etclocaltime file is a binary format; you 
shouldn’t attempt to edit it in a text editor, making option D incorrect. 


13. D. Linux, like Unix, maintains its time internally in Coordinated Universal 
Time (UTC), so setting the computer’s hardware clock to UTC (option D) 
is the recommended procedure for computers that run only Linux. Although 
Linus Torvalds spent time at the University of Helsinki, Helsinki time (as in 
option A) has no special place in Linux. Local time (as in option B) is 
appropriate if the computer dual-boots to an OS, such as Windows, that 
requires the hardware clock to be set to local time, but this is the second- 
best option for a Linux-only system. Option C’s US Pacific time, like 
Helsinki time, has no special significance in Linux. Internet time (option E) 
is an obscure way to measure time that divides each day into 1,000 “beats.” 
It’s not a time zone and is not an appropriate way to set your hardware 
clock. 


14. C. When set, the LC_ALL environment variable (option C) adjusts all the 
locale (LC_*) variables, so setting this and then running the script will make 
the programs that your script uses work as if on a British computer. The 
BIOS has no location code data, so option A is incorrect. There is no 
standard etclocale.conf file, so option B is incorrect. There is no standard 
locale_set utility, so option D is incorrect. Although setting the TZ 
environment variable, as in option E, will set the time zone for your local 
shell to that for Great Britain, this won’t affect the sort of text formatting 
options noted in the question. 


15. A. The Unicode Transformation Format 8 (UTF-8) standard can encode 
characters for just about any language on Earth, while looking just like 
ordinary ASCII to programs that only understand ASCII. Thus UTF-8 
(option A) is the preferred method for character encoding when a choice is 
possible. ASCII (option B) is an old standard that’s adequate for English 
and a few other languages, but it lacks some or all characters needed by 
most languages. ISO-8859 (options C and D) is a standard that extends 
ASCII, but it requires separate encodings for different languages and so it is 
awkward when a computer must process data from multiple languages. 
ATASCI (option E) is a variant of ASCII used in the 1980s by Atari for its 
home computers; it’s obsolete and inadequate today. 


16. E. The smart filter makes a print queue “smart” in that it can accept 
different file types (plain text, PostScript, graphics, and so on) and print 
them all correctly, as in option E. Font smoothing is useful on low- 
resolution computer monitors, but not on most printers, and adding font 
smoothing is not a function of a smart filter, so option A is incorrect. A 
smart filter doesn’t detect confidential information (option B) or prank print 
jobs (option D). The lpr program can be given a parameter to email a user 
when the job finishes (option C), but the smart filter doesn’t do this. 


17. B, D. The job ID (option B) and job owner (option D) are both displayed 
by lpq. Unless the application embeds its own name (option A) in the 
filename, that information won’t be present. Most printers lack Linux 
utilities to query ink or toner status (option C); certainly 1pq can’t do this. 
Although knowing when your job will finish printing (option E) would be 
handy, providing this information is well beyond 1pq’s capabilities. 


18. C. The lprm command (option C) deletes a job from the print queue. It can 
take the -Pqueue option to specify the queue and a print job number or 
various other parameters to specify which jobs to delete. BSD LPD, LPRng, 
and CUPS all implement the 1prm command, so you can use it with any of 
these systems, making option A incorrect. Option B presents the correct 
syntax but the wrong command name; there is no standard 1pdel command. 
The cupsdisable command can be used to disable the whole queue but not 
to delete a single print job, so option D is incorrect. Because option C is 
correct, option E obviously is not. 


19. B. PostScript is the de facto printing standard for Unix and Linux 
programs, as specified in option B. Linux programs generally do not send 
data directly to the printer port (option A); on a multitasking, multiuser 
system, this would produce chaos because of competing print jobs. 
Although a few programs include printer driver collections, most forgo this 
in favor of generating PostScript, making option C incorrect. Printing 
utilities come standard with Linux; add-on commercial utilities aren’t 
required, so option D is incorrect. Verdana is one of several “web fonts” 
released by Microsoft. Although many Linux programs can use Verdana for 
printing if the font is installed, most Linux distributions don’t install 
Verdana by default, and few Linux programs use it for printing by default 
even if it’s installed, so option E is not correct. 


20. B. The mpage utility (option B) prints multiple input pages on a single 
output page, so it’s ideally suited to the specified task. PAM (option A) is 


the Pluggable Authentication Modules, a tool for helping to authenticate 
users. 4Front (option C) is the name of a company that produces 
commercial sound drivers for Linux. The route command (option D) is 
used to display or configure a Linux routing table. The 411toppm program 
(option E) converts files from Sony’s 411 image file format to the PPM 
image file format; it doesn’t do the specified task. 


Chapter 7: Administering the System 


1. E. When the usermod -L username command is used, the username record 
in the etcshadow file has its password field modified. An exclamation point 
(:) is placed in front of the password, making the password inoperable and 
thus locking the account. Therefore, option E is correct. An x exists in the 
etcpasswd file’s records’ password field, if the etcshadow file is used for 
passwords (which it should be) and does not indicate a locked account. 
Therefore, option A is incorrect. Option B is only true when an account has 
not yet had a password set. Therefore, option B is incorrect. Option C is 
also incorrect. You would never have a blank password field for a user 
account’s etcshadow record, unless the file had been incorrectly manually 
modified. Manual modifications of the etcshadow files are never 
recommended. A user record could have a zero (0) as the first character in 
their password field, but this would be due to the password being hashed, 
not locked. Therefore, option D is incorrect. 


2. A, B, C. The useradd command is used to add user accounts to a Linux 
system, and therefore option A is correct. The adduser command is 
available on some Linux distributions, and it also allows you to add user 
accounts to the system. Thus, option B is correct as well. The useradd 
command has a valid -c option that allows you to enter comments, such as 
a user’s full name. Therefore, option C is also correct. There is no usradd 
command, so option D is incorrect. The passwd command cannot add users 
to the system. Therefore, option E is incorrect. 


3. A. The chage command changes various account expiration options. The -M 
parameter sets the maximum number of days for which a password is valid, 
and in the context of the given command, time is a username. Thus, option 
A is correct. Options B, C, D, and E are all made up. 


4. D. The etcpasswd entries have third and fourth fields of the UID and the 
GID, but this line has only one of those fields (which one is intended is 
impossible to determine); this example line’s fourth field is clearly the fifth 
field of a valid entry. Thus, option D is the correct answer. Option A is 
incorrect because, although binpasswd is an unorthodox login shell, it’s 
perfectly valid. This configuration might be used on, say, a Samba file 
server or a POP mail server to enable users to change their passwords via 
SSH without granting login shell access. The sally username is valid and 


thus, Option B is not a correct answer. You may have usernames that are all 
lowercase letters. Option C is a correct observation, but an incorrect 
answer; the username and the user’s home directory name need not match. 
The hashed password is officially stored in the second field, but in practice, 
most Linux computers place the hashed passwords in the etcshadow file. 
An x value for the password is consistent with this use, so option E is 
incorrect. 


5. E. Option E is the best way to accomplish the task, because it will add sally 
to the Development group without removing her from any other groups or 
potentially damaging the etcgroup file. Option A would attempt to add the 
groups Development and sally to the system, thus it is not even a valid 
choice. Option B, also not a valid choice, would attempt to add the groups 
Production and sally. Option C would work, but it is very dangerous to 
edit an account configuration file manually instead of using account tools. 
Therefore, option C is not the best choice. Option D would work, but it 
would remove sally from all of her other groups, including the 
Production group. Therefore, option D is not the best choice either. 


6. B, C, D. Files in etcskel are copied from this directory to the new users’ 
home directories by certain account-creation tools. Thus, files that you want 
in all new users’ home directories should reside in etcskel. Options B, C, 
and D all describe reasonable possibilities, although none is absolutely 
required. Including a copy of etcshadow in etcskel (option A) would be a 
very bad idea because this would give all users access to all other users’ 
hashed passwords, at least as of the moment of account creation. You 
wouldn’t likely find package management databases (option E) in etcskel, 
since users don’t need privileged access to this data, nor do they need 
individualized copies of it. 


7. C. The userdel command deletes an account, and the -r option to userdel 
(option C) causes it to delete the user’s home directory and mail spool, thus 
satisfying the terms of the question. Option A deletes the account but leaves 
the user’s home directory intact. Option B does the same; the -f option 
forces account deletion and file removal under some circumstances, but it’s 
meaningful only when -r is also used. Option D’s rm command deletes the 
user’s home directory (assuming that it’s located in the conventional place, 
given the username) but doesn’t delete the user’s account. Option E’s 
usermod command can modify accounts, including locking them, but it 
can’t delete accounts. Furthermore, the -D option to usermod is fictitious. 


8. E. The emerg priority code (option E) is the highest code available and so is 
higher than all the other options. From highest to lowest priorities, the 
codes given as options are emerg, crit, warning, info, and debug. 


9. A. The logrotate program consults a configuration file called 
etclogrotate.conf (option A), which includes several default settings and 
typically refers to files in etclogrotate.d to handle specific log files. The 
remaining options are all fictitious, at least as working log files for 
logrotate. 


10. D. The logger utility can be used to create a one-time log file entry that 
you specify. In its simplest form, it takes no special arguments, just a 
message to be inserted in the log file, as in option D. The dmesg utility in 
option A is used to review the kernel ring buffer; it doesn’t create log file 
entries. Option B’s syslog command isn’t a Linux user-mode command, 
although it is the name of the logging system generically as well as a 
programming language command name. Option C’s rsyslogd is the name 
of one of several system logging daemons; it maintains the system log, but 
isn’t used to manually insert log entries. Option E’s wall command writes a 
message to all users logged into virtual console terminals. It won’t create a 
log file entry as the question requires and is not installed on all 
distributions. 


11. C. The logrotate program can be started automatically—and unattended 
—on a regular basis by adding an entry for it in cron, so option C is correct. 
The at utility (option A) would be used if you wanted the program to run 
only once. Option B, logrotate. d, is a file stored in the /etc directory, 
which defines how the program is to handle specific log files. The inittab 
file (option D) is used for services and startup and not for individual 
programs. The ntpd program (option E) is the Network Time Protocol 
daemon, which synchronizes the system’s clock with outside time sources. 


12. E. The hwclock utility is used to view or set the hardware clock. The -- 
systohc sets the hardware clock based on the current value of the software 
clock, thus option E is correct. Option A’s date utility can be used to set the 
software clock but not the hardware clock; it has no --sethwclock option. 
Option B’s ntpdate is used to set the software clock to the time maintained 
by an NTP server; it doesn’t directly set the hardware clock. Option C’s 
sysclock utility is fictitious. Option D’s time command is used to time 
how long a command takes to complete; it has no --set or --hw option and 
does not set the hardware clock. 


13. A. The format of the date command’s date code is [MMDDhhmm[ [CC] YY] 
[.ss]]. Given that the question specified an eight-digit code, this means 
that the ordering of the items, in two-digit blocks, is month-day-hour- 
minute. Option A correctly parses this order, whereas options B, C, D, and 
E do not. 


14. C. Multiple server entries in etcntp.conf tell the system to poll all of the 
named servers and to use whichever one provides the best time data. Thus 
option C is correct. (The pool.ntp.org subdomain and numbered 
computers within that subdomain give round-robin access to a variety of 
public time servers.) Options A and B both incorrectly state that one server 
statement overrides another, when in fact this isn’t the case. The server 
statements shown in the question are properly formed. These server entries 
are properly formed, so option D is incorrect. Although it is true that this 
configuration will result in use of tardis.example.com should the public- 
pool server be unavailable, as option E states, this is not the only reason the 
NTP server will use tardis.example.com; this could happen if the public- 
pool server provides an inferior time signal, for instance. Thus option E is 
incorrect. 


15. D. Once you’ve configured one computer on your network to use an 
outside time source and run NTP, the rest of your computers should use the 
first computer as their time reference. This practice reduces the load on the 
external time servers as well as your own external network traffic. Thus 
option D is correct. (Very large networks might configure two or three 
internal time servers that refer to outside servers for redundancy, but this 
isn’t necessary for the small network described in the question.) Option A 
describes the procedure to locate a time server for the first computer 
configured (gateway . pangaea. edu) but not for subsequent computers. 
Although configuring other computers to use ntp.example.com instead of 
or in addition to gateway . pangaea. edu is possible, doing so will needlessly 
increase your network traffic and the load on the ntp.example.com server. 
Thus options B and C are both incorrect. Contrary to option E, NTP is 
suitable for use on small local networks, and in fact it’s very helpful if you 
use certain protocols, such as Kerberos. 


16. B, D. The cron utility is a good tool for performing tasks that can be done 
in an unsupervised manner, such as deleting old temporary files (option B) 
or checking to see that disk space is not low (option D). Tasks that require 
interaction or do not occur on a scheduled basis, such as creating accounts 


(option C), aren’t good candidates for cron jobs, which must execute 
unsupervised and on a schedule. Although a cron job could restart a 
crashed server, it’s not normally used to start a server when the system 
boots (option A); that’s done through system startup scripts or a super 
server. Sending files to a printer (option E) is generally handled by a print 
server such as the cupsd daemon. 


17. B. User cron jobs don’t include a username specification (tbaker in 
options A and C). The */2 specification for the hour in options C and D 
causes the job to execute every other hour; the 7, 19 specification in options 
A and B causes it to execute twice a day, on the 7th and 19th hours (in 
conjunction with the 15 minute specification, that means at 7:15 a.m. and 
7:15 p.m.). Thus, option B provides the correct syntax and runs the job 
twice a day, as the question specifies, whereas options A, C, and D all get 
something wrong. Option E causes the job to run once an hour, not twice a 
day. 


18. B. The anacron program is a supplement to cron that helps ensure that log 
rotation, daily backups, and other traditional cron tasks are handled even 
when the computer is shut down (and, hence, when cron isn’t running) for 
extended periods of time. This is the program to add to the system to 
achieve the stated goal, and option B is correct. There is no common Linux 
utility called tempus, so option A is incorrect. Option C’s crontab is the 
name of a file or program for controlling cron, which is likely to be an 
unreliable means of log rotation on a laptop computer. The ntpd program 
(option D) is the NTP daemon, which helps keep the system clock in sync 
with an external source. Although running ntpd on a laptop computer is 
possible, it won’t directly help with the task of scheduling log rotation. The 
syslog-ng package is an alternative system log daemon, but this program 
doesn’t help solve the problem of missed daily backups when using 
standard cron utilities, so option E is incorrect. 


19. E. The at command runs a specified program at the stated time in the 
future. This time may be specified in several ways, one of which is 
teatime, which stands for 4:00 p.m. Thus, option E is correct. The 
objections stated in options A, B, C, and D are all invalid. (You may pass a 
script to at with the -f parameter, but this isn’t required, contrary to option 
D.) 


20. A, C. The contents of etccron.daily are automatically run on a daily 
basis in most Linux distributions, and the crontab utility can create user 


cron jobs that run programs at arbitrary time intervals, so both A and C are 
correct. The at command noted in option B can be used to run a program a 
single time, but not on a regular basis (such as daily). Option D’s run- 
parts utility is used by some distributions as a tool to help run programs in 
the etccron.* subdirectories, but it’s not used to schedule jobs. Although 
the crontab program can maintain user crontabs, it’s not used as shown in 
option E and it has no -d parameter at all. 


Chapter 8: Configuring Basic Networking 


1. A, B, E. Ethernet (option B) is currently the most common type of wired 
network hardware for local networks. Linux supports it very well, and 
Linux also includes support for Token Ring (option A) and Fibre Channel 
(option E) network hardware. DHCP (option C) is a protocol used to obtain 
a TCP/IP configuration over a TCP/IP network. It’s not a type of network 
hardware, but it can be used over hardware that supports TCP/IP. NetBEUI 
(option D) is a network stack that can be used instead of or in addition to 
TCP/IP over various types of network hardware. Linux doesn’t support 
NetBEUI directly. 


2. B. IP addresses consist of four 1-byte numbers (0-255). They’re normally 
expressed in base 10 and separated by periods. 63.63.63.63 meets these 
criteria, so option B is correct. 202.9.257.33 includes one value (257) that’s 
not a 1-byte number, so option A is incorrect. 107.29.5.3.2 includes five 1- 
byte numbers, so option C is incorrect. 98.7.104.0/24 (option D) is a 
network address—the trailing /24 indicates that the final byte is a machine 
identifier, and the first 3 bytes specify the network. Option E, 
255.255.255.255, meets the basic form of an IP address, but it’s a special 
case—this is a broadcast address that refers to all computers rather than to 
the single computer specified by the question. 


3. C. The gateway computer is a router that transfers data between two or more 
network segments. As such, if a computer isn’t configured to use a 
gateway, it won’t be able to communicate beyond its local network 
segment, making option C correct. A gateway is not necessary for 
communicating with other systems on the local network segment, so option 
A is incorrect. If your DNS server is on a different network segment, name 
resolution via DNS won’t work, as stated in option B; however, other types 
of name resolution, such as etchosts file entries, will still work, and the 
DNS server might be on the local network segment, so option B is 
incorrect. Gateways perform the same function in both IPv4 and IPv6 
networking, so option D is incorrect. DHCP functions fine without a 
gateway, provided that a DHCP server is on the same local network 
segment as its clients (as is normally the case), so option E is incorrect. 


4. D. The Secure Shell (SSH) protocol uses port 22, so if the traffic to port 22 
is using the correct protocol, it’s SSH traffic and option D is correct. The 


Hypertext Transfer Protocol (HTTP; option A) is conventionally bound to 
port 80; the Simple Mail Transfer Protocol (SMTP; option B) uses port 25; 
Telnet (option C) uses port 23; and the Network News Transfer Protocol 
(NNTP; option E) uses port 119. None of these would normally be directed 
to port 22. 


5. D. The Interactive Mail Access Protocol (IMAP) is assigned to TCP port 
143. Ports 21, 25, 110, and 443 are assigned to the File Transfer Protocol 
(FTP), the Simple Mail Transfer Protocol (SMTP), the Post Office Protocol 
version 3 (POP3), and the Hypertext Transfer Protocol over SSL (HTTPS), 
respectively. Although some IMAP server programs also support POP3 and 
might therefore listen to both ports 110 and 143, the question specifies 
IMAP exchanges, so option D is the only correct answer. 


6. C, E. Option C, dhcpd, is the Linux DHCP server. Option E, ifconfig, can 
be used for network configuration but is not itself a DHCP client. The 
others are all DHCP clients. Any given computer will use just one DHCP 
client (or none at all), but any one of A, B, or D will be available choices. 


7. B, C. When used to display information on an interface, ifconfig shows the 
hardware and IP addresses (options B and C) of the interface, the protocols 
(such as TCP/IP) bound to the interface, and statistics on transmitted and 
received packets. This command does not return information about 
programs using the interface (option A), the hostname associated with the 
interface (option D), or the kernel driver used by the interface (option E). 


8. A. The host program (option A) is a commonly used program to perform a 
DNS lookup. There is no standard dnslookup program (option B), although 
the nslookup program is a deprecated program for performing DNS 
lookups. pump (option C) is a DHCP client. ifconfig (option D) is used for 
configuration of networking parameters and cards. netstat (option E) is a 
general-purpose network diagnostic tool. 


9. B. To add a default gateway of 192.168.0.1, the command would be route 
add default gw 192.168.0.1, as in option B. Specifying the IP address of 
the host system (as in options A, C, and D) is not necessary and in fact will 
confuse the route command. Although route provides a -host option, 
using host (without a dash), as in option E, is incorrect. Furthermore, 
option E omits the critical add parameter. 


10. A, B. The dhclient utility, if installed, attempts to configure and bring up 
the network(s) passed to it as options (or all networks if it’s given no 


options) using a DHCP server for guidance. Thus option A may work, 
although it won’t work if no DHCP server is available. Option B applies 
whatever network options are configured using distribution-specific tools 
and brings up the network. Thus options A and B both may work, although 
neither is guaranteed to work. Option C displays the network status of eth1, 
but it won’t activate eth1 if it’s not already active. There is no standard 
network utility in Linux, so option D won’t work. The netstat utility is a 
network diagnostic tool; it won’t bring up a network interface, so option E 
is incorrect. 


11. E. Although not all systems use etchostname, option E correctly describes 
it for those systems that use it. The file or files that hold information on 
package repository servers vary from one package system to another, so 
option A is incorrect. Option B describes the purpose of etcresolv.conf. 
Option C describes the purpose of etchosts. Option D doesn’t describe any 
standard Linux configuration file, although the gateway computer’s IP 
address is likely to appear in a distribution-specific configuration file. 


12. C. The traceroute command (option C) identifies the computers that lie 
between your own computer and a destination computer, along with some 
very basic information about network packet travel time and reliability. 
Thus, traceroute can help you track down the source of the described 
problem—perhaps a router that’s critical to reaching all of the non- 
responsive systems has failed. The netstat and ifconfig utilities of 
options A and D both provide information about local network 
configuration options, but they most likely won’t be of much help in 
diagnosing a problem that affects only some sites. The ping utility (option 
B) may help you quickly identify sites that have failed but won’t be of 
much use beyond that. You can use dig (option E) to obtain information on 
the mapping of hostnames to IP addresses, but it won’t help in resolving 
basic connectivity problems. 


13. B. Both global and link-local IPv6 addresses can use the system MAC 
address as part of the IPv6 address, thus option A is incorrect. The fee 
network address identifies a site-local address but not a link-local address, 
so option C is also incorrect. An address that starts with 2001 would be a 
normal global address, making option D incorrect. IPv6 link-local addresses 
start with fe80, thus C is the correct answer. 


14. C. The netstat program produces various network statistics, including the 
process IDs (PIDs) and names of programs currently accessing the network 


when it’s passed the -p parameter, thus option C is correct. The ifconfig 
program can’t produce this information, and the -p option to this program is 
fictitious, so option A is incorrect. Option B’s procnetwork/programs file 
is also fictitious. Option D’s etcxinetd.conf file is real and may provide 
some information about some servers that are using the network (as 
described in Chapter 10), but this file won’t provide information about all 
servers, much less about clients that are accessing the network. The dmesg 
command displays the kernel ring buffer, which doesn’t contain 
information on programs that are currently accessing the network, so option 
E is incorrect. 


15. A, D. If you get any response at all, you know that the basic network 
connection is working, including that the server is responding to the client. 
With basic knowledge of IMAP commands, telnet enables you to test the 
server’s responses in more detail than most IMAP clients (mail readers) 
permit. Thus options A and D are both correct. Option B describes the 
functionality of traceroute or tracepath; telnet provides no information 
about intermediate routers’ functionality, so option B is incorrect. Because 
neither telnet nor IMAP on port 143 uses encryption, option C is 
incorrect. Furthermore, a packet sniffer is likely to have no effect on the 
transfer of data; it just copies the data so that the packet sniffer’s user can 
see it. Although telnet can be used for remote access in a way that could 
make option E correct, the question specifies using telnet to connect to 
port 143, which is the IMAP port, not the Telnet port. Thus, option E is 
incorrect. (Furthermore, using telnet for remote administration is very 
risky because telnet is an unencrypted protocol.) 


16. B. The computer’s IP address (172.25.78.89) and netmask (255.255.255.0) 
mean that the computer can directly address computers with IP addresses in 
the range of 172.25.78.1 to 172.25.78.254, but the gateway address 
(172.25.79.1) is outside of this range. Thus, either the IP address or the 
gateway address is wrong, and option B is correct. Nothing about the way 
DNS operates necessitates that the DNS server be on the same network 
segment as the DNS client, so option A is incorrect. Although private IP 
addresses are often isolated from the Internet, as option C specifies, 
Network Address Translation (NAT) can get around this limitation. Thus, 
although there could be some truth to option C, it’s not certain to be true. 
The Class A/B/C distinctions are just guidelines that can be overridden by 
specific configurations. Thus option D is incorrect. Option E’s assertion 
that ifup is used only on computers that use DHCP is incorrect; ifup can 


work on computers that use static IP addresses provided the relevant 
information is entered correctly. 


17. E. The -n option is used when you want to use route to display the current 
routing table, and it does as option E specifies. There is no route parameter 
that behaves as options A or C specify. Option B describes the purpose of 
the netmask parameter to route. Option D describes the purpose of the - 
net parameter to route. 


18. E. Option E correctly identifies the function of etcresolv.conf. Option A 
describes the purpose of etcservices. Various distribution-specific 
configuration files perform the function described in option B, but 
etcresolv.conf is not one of these files. A DHCP client sends a broadcast 
to locate a DHCP server; there is no client configuration file that holds the 
DHCP server’s address, as option C describes. The routing table is 
maintained internally, although basic routing information may be stored in 
distribution-specific configuration files, so option D is also incorrect. 


19. B. The etchosts file holds mappings of IP addresses to hostnames, on a 
one-line-per-mapping basis. Thus option B is correct. The file does not list 
the users (option C) or other hosts (option A) allowed to access this one 
remotely, affect remote administration through a web browser (option D), 
or map port numbers to protocols (option E). 


20. D. The etcnsswitch.conf file controls the order of name resolution, 
among other things. Option D correctly describes the procedure for 
changing the order in which Linux performs name resolution. The 
etcresolv.conf file mentioned in option A controls the DNS servers that 
Linux consults, but it doesn’t control access to etchosts. Option B’s 
nslookup command resolves a hostname, so option B will return the IP 
address of the computer called dns, if Linux can find such a system. The 
etcnamed.conf file of option C is the configuration file for the standard 
name server. This server isn’t likely to be installed on most Linux systems, 
and even if it is, the procedure described in option C is invalid. Like option 
B’s nslookup, option E’s dig looks up hostname-to-IP-address mappings, 
so option E will display such mappings for the computers called local and 
dns, if they exist. 


Chapter 9: Writing Scripts, Configuring Email, 
and Using Databases 


1. D. The PS1 environment variable contains various formatting codes 
preceded by a backslash (\) as well as text to be included in the primary 
command prompt. Therefore, option D is correct. There is no environment 
variable called PROMPT, nor is there an environment variable called PSI, so 
options A and B are incorrect. Programs that use a pager, such as less or 
more, use the PAGER environment variable. If the variable is set, the 
programs use the pager listed in the variable. Therefore, option C is 
incorrect. Option D is correct, so option E is incorrect. 


2. A. The alias built-in command creates a duplicate name for a (potentially 
much longer) command. Option A shows the correct syntax for using this 
built-in command. It causes the new alias cdpt to work like the much 
longer cd ~/papers/trade. The export command in option B creates an 
environment variable called cdpt that holds the value cd ~/papers/trade. 
This will have no useful effect. Option C, if placed in a bash startup script, 
will cause an error because it uses incorrect alias command syntax, as 
does option D. Although env is a valid command, it’s used incorrectly in 
option E, and so this option is incorrect. 


3. E. Some programs use the EDITOR environment variable as described in 
option E. Contrary to option A, the EDITOR environment variable has 
nothing to do with command-line editing. When you’re typing at a bash 
command prompt, bash itself provides simple editing features, so option B 
is incorrect. (You can launch the editor specified by $EDITOR by typing 
Ctrl+X followed by Ctrl+E, though.) The edit command doesn’t behave as 
option C suggests. (This command may be configured differently on 
different systems.) You can create links called GUI and TEXT to have the 
EDITOR environment variable behave as option D suggests, but this isn’t a 
normal configuration. 


4. C. The PwD environment variable holds the present working directory, so 
option C is correct. The PATH environment variable (option A) holds a 
colon-delimited list of directories in which executable programs are stored 
so that they may be run without specifying their complete pathnames. There 
are no standard CWD, PRESENT, Or WORKING environment variables, so options 
B, D, and E are all incorrect. 


5. A, C. Option A creates the desired environment variable. Option C also 
creates the desired environment variable. It combines the variable setting 
and the export of the MYVAR variable using a different method than option A 
uses. It combines the two commands on one line using a semicolon (; ). 
Option B creates a local variable—but not an environment variable—called 
MYVAR, holding the value mystuff. After typing option B, you can also type 
export MYVAR to achieve the desired goal, but option B by itself is 
insufficient. Option D displays the contents of the MYVAR variable and also 
echoes mystuff to the screen, but it doesn’t change the contents of any 
environment variable. Option E’s setenv isn’t a valid bash command, but it 
will set an environment variable in tcsh. 


6. E. The ~/.bashrc file is a non-login bash startup script file. As such, it can 
be used to alter a user’s bash environment, and option E is correct. The 
etcinputrc file is a global bash configuration file for keyboard 
customization and setting terminal behavior. The ~/.inputrc file is for 
users to create or modify their own keyboard configuration file. Therefore, 
option A is incorrect. The etcbashrc file is a global bash startup script. 
Editing it will modify users’ bash environments, but an individual user 
should not be able to modify it, so option B is incorrect. There is no 
standard $HOME/bashrc file because the filename is missing its prefixed 
period (.). Thus, option C is incorrect. Likewise, option D’s 
$HOME/ .profile_bash doesn’t refer to a user’s configuration file and is 
incorrect. However, there is a $HOME/.bash_profile bash configuration 
file. 


7. A, D. The env command displays all defined environment variables, so 
option A satisfies the question. (In practice, you might pipe the results 
through grep to find the value of a specific environment variable.) The 
echo command, when passed the name of a specific environment variable, 
displays its current value, so option D is also correct. DISPLAY is an 
environment variable, but it’s not a command for displaying environment 
variables, so option B is incorrect. You can use the export command to 
create an environment variable but not to display the current settings for 
one, so option C is incorrect. Option E’s cat command concatenates files or 
displays the contents of a file to the screen, but it doesn’t display 
environment variables. 


8. B. Before using the ./ execution method, the script must have at least one 
executable bit set. Therefore, an error will be generated since chmod was not 


used to modify the execute permissions on the a_script file. Thus Option 
B is the correct choice since it would not work. Option A uses the bash 
command to execute a script, and this will work fine without any file 
permission changes. Likewise, when you source a file using either the 
source command or a dot (.) and a space, there is no need to modify a 
scripts permission bits before executing the file. Therefore, option C and 
option D are incorrect because they also work fine. 


9. C. The cp command is the only one called in the script, and that command 
copies files. Because the script passes the arguments ($1 and $2) to cp in 
reverse order, their effect is reversed—where cp copies its first argument to 
the second name, the cp1.sh script copies the second argument to the first 
name. Thus, option C is correct. Because the order of arguments to cp is 
reversed, option A is incorrect. The cp command has nothing to do with 
compiling (option B) or converting (option D) C or C++ programs, so 
neither does the script. The reference to binbash in the first line of the 
script identifies the script itself as being a bash script; it does not cause the 
arguments to the script to be run as bash scripts, so option E is incorrect. 


10. E. The commands iterated by the for, while, and until loops are located 
between the do and done constructs. Therefore, option E is correct. 
Commands in the then statement section are for an if -then construct, not a 
loop, thus option A is incorrect. Double semicolons are used for case 
constructs, but not loops, and so option B is incorrect. The case and esac 
keywords begin and end a case construct, and thus option C is incorrect. A 
test statement can be used to determine whether or not a loop’s commands 
should iterate or not. However, it does not contain the actual commands to 
be iterated, and therefore option D is incorrect. 


11. B, C. Valid shell scripts begin with the characters #! and the complete path 
to a program that can run the script. Options B and C both meet this 
description, because binbash is a shell program that’s installed on virtually 
all Linux systems and bintcsh is often also available. There is no standard 
binscript program, so option A is incorrect. Options D and E are both 
almost correct; binsh is typically linked to a valid shell and binzsh is a 
valid shell on many systems, but the order of the first two characters is 
reversed, so these options are incorrect. 


12. A, B, D. The for, while, and until statements are all valid looping 
statements in bash, so options A, B, and D are all correct. The if-then 
statement in bash’s scripting language tests a condition and, if it is true, 


executes its commands one time only. Therefore, option C is incorrect. The 
case Statement is a conditional, not a looping statement in bash, so option E 
is incorrect. 


13. B. When aliases are properly configured, any email addresses sent to the 
email with an alias is received by the alias account. Therefore, option B is 
correct. The postmaster username would not receive the email because the 
alias is set to john, and so option A is incorrect. The ~/. forward file is 
associated with email forwarding, not aliases. Therefore, option C is 
incorrect. There is no reason for root to receive this email, so option D is 
incorrect. An alias does allow email to be sent to the alias account, so the 
statement in Option E does not make sense and is incorrect. 


14. C. The Fetchmail program is a tool for retrieving email from remote POP 
or IMAP servers and injecting it into a local (or remote) SMTP email 
queue. As such, it’s not an SMTP server, so option C is correct. Postfix 
(option A), sendmail (option B), Exim (option D), and qmail (option E) are 
all popular SMTP email servers for Linux. 


15. B. The -s option to mail sets the message subject line, and -c sets carbon 
copy (cc:) recipients. Input redirection (via <) reads the contents of a line 
into mail as a message. A mail command line normally terminates with the 
primary recipient. Thus, option B correctly describes the effect of the 
specified line. Options A, C, D, and E are all confused in their 
interpretation of the effects of mail parameters. Options A, B, and D also 
confuse input and output redirection, and option A incorrectly suggests that 
a script (or the mail program) can elevate its run status to root privileges. 


16. D. To view your mail queue, use the mailq command (option D). The 
service sendmail status command is a SysV service status command 
and does not show mail queues, so option A is incorrect. Option B is a 
printer command and is therefore incorrect. Option C is close, but the 
correct command is sendmail -bp not -bq. Option E will show you the 
various directories within varspool and is therefore not the correct 
command. 


17. B. The etcaliases file configures system-wide email forwarding. The 
specified line does as option B describes. A configuration like this one is 
common. Option A has things reversed. Option C is not a valid conclusion 
from this evidence alone, although an intruder conceivably may be 
interested in redirecting root’s email, so if jody shouldn’t be receiving 


root’s email, this should be investigated further. Although the effect of 
option D (jody reading root’s email) is nearly identical to the correct 
answer’s effect, they are different; jody cannot directly access the file or 
directory that is root’s email queue. Instead, the described configuration 
redirects root’s email into jody’s email queue. Thus, option D is incorrect. 
Because etcaliases is an email configuration file, not an account 
configuration file, it can’t have the effect described in option E. 


18. B. The CREATE DATABASE command creates a new database with the 
specified name. Because SQL commands are case insensitive, this 
command may be typed in uppercase or lowercase, and option B is correct. 
Options A and C both use the incorrect command NEw rather than CREATE, 
and option C specifies the database name as FISH rather than fish. 
(Database names are case sensitive.) Option D reverses the order of the 
CREATE and DATABASE keywords. Option E uses the fictitious command DB. 


19. A, D. A single database may hold multiple tables, as option A suggests. 
Option D is also correct; if data is split across tables (such as into tables 
describing objects generically and specifically), databases can be more 
space efficient. Option B is incorrect because the DROP command doesn’t 
combine tables—it deletes a table! Option C is incorrect because it reverses 
the meaning of rows and columns in a SQL table. A lossy compression 
algorithm, as the name suggests, deliberately corrupts or loses some data— 
an unacceptable option for a text database, making option E incorrect. 
(Lossy compression is used for some audio and video file formats, though.) 


20. C. The UPDATE command modifies existing database table entries, and in 
this case it does so as option C describes. Option B also describes an update 
operation, but in a confused and incorrect way. Options A and D both 
describe database retrieval operations, but UPDATE doesn’t retrieve data. 
Option E mistakenly identifies stars as a database name, but it’s a table 
name, and it mistakenly identifies the operation as adding a new entry 
(INSERT in SQL) rather than as modifying an existing entry (UPDATE in 


SQL). 


Chapter 10: Securing Your System 


1. E. The server names alone are insufficient to determine whether they’re 
legitimate. The computer in question may or may not need to run any of 
these servers, and their presence may or may not be intentional, accidental, 
or the sign of an intrusion. Thus, option E is correct. Contrary to option A, 
the mere presence of an SSH server does not ensure security. Although, as 
option B asserts, FTP is not a secure protocol, it’s still useful in some 
situations, so the mere presence of an FTP server is not, by itself, grounds 
for suspicion. Similarly, in option C, although some administrators prefer 
Postfix or qmail to sendmail for security reasons, sendmail isn’t 
necessarily bad, and the names alone don’t guarantee that the sshd and 
proftpd servers are legitimate. As option D states, sendmail and proftpd 
both use unencrypted text-mode transfers, but this is appropriate in some 
situations, so option D is incorrect. 


2. C. Although Nmap and other port scanners are useful security tools, 
troublemakers also use them, and many organizations have policies 
restricting their use. Thus, you should always obtain permission to use such 
tools prior to using them, as option C specifies. A port scanner can’t cause 
damage to etcpasswd, so there’s no need to back it up, contrary to option 
A. A port scanner also doesn’t need the root password on a target system to 
operate, so you don’t need this information, making option B incorrect. (In 
fact, asking for the root password could be seen as extremely suspicious! ) 
Although you could use sudo to run Nmap, there’s no need to do so to 
perform a TCP scan, and you can perform a UDP scan by running Nmap as 
root in other ways (such as via a direct login or by using su). Thus, option 
D isn’t strictly necessary, although you might want to tweak etcsudoers as 
a matter of system policy. Because a firewall is part of your network’s 
security, you probably want it running when you perform a network scan, 
contrary to option E. Furthermore, it would be safer to leave the firewall 
running and scan from behind it if you want to test the security of the 
network in case of a firewall breach. 


3. C. The etcsecurity/limits.conf (option C) file holds the configuration 
settings that allow you to limit users’ access. The other options listed don’t 
give the correct path to this file. 


4. A, B, C. Nmap (option A) is usually used to perform scans of remote 


computers, but it can scan the computer on which it’s run as well. The 
netstat (option B) and lsof (option C) utilities can both identify programs 
that are listening for connections (that is, open ports) on the local computer. 
The Network File System (NFS) and some other servers use the portmap 
program (option D), but it’s not used to identify open ports. There is no 
standard Linux services program (option E), although the etcservices 
file holds a mapping of port numbers to common service names. 


5. B. The -perm option to find locates files with the specified permissions, and 
+4000 is a permission code that matches SUID files. The -type f option 
restricts matches to files in order to avoid false alarms on directories. 
Option B uses these features correctly. Options A, C, and D use these 
features incorrectly. Option E specifies a fictitious -suid parameter to find. 


6. A. Option A correctly describes the meaning of the specified line. A percent 
sign (%) identifies a Linux group name, and the remainder of the line tells 
sudoers to enable users of that group to run all programs as root by using 
sudo. The remaining options all misinterpret one or more elements of this 
configuration file entry. 


7. B. The netstat command can do what is described in the question. The -ap 
options to the command are good choices to discover all the open network 
connections, so option B is correct. Although 1sof can also accomplish the 
job, the -c a option is incorrect; this option restricts output to processes 
whose names begin with a. Thus, option A is incorrect. Option C’s 
ifconfig command doesn’t display open network connections, so it’s 
incorrect. Although option D’s nmap command will locate ports that are 
open on the localhost interface, it doesn’t locate all open connections, nor 
does it locate connections on anything but the localhost interface. Option 
E’s top command displays a list of processes sorted by CPU use, not open 
network connections (-net is an invalid option to top as well). 


8. D. Option D is correct. TCP wrappers uses this feature to allow you to 
override broad denials by adding more specific access permissions to 
hosts.allow, as when setting a default deny policy (ALL : ALL) in 
hosts.deny. 


9. C. The bind option of xinetd lets you tie a server to just one network 
interface rather than link to them all, so option C is correct. It has nothing to 
do with running multiple servers on one port (option A), specifying 
computers by hostname (option B), resolving conflicts between servers 


(option D), or the Berkeley Internet Name Domain (BIND) or any other 
DNS server (option E). 


10. A, D. Using a firewall rule to block Waiter’s port, as in option A, can 
increase security by providing redundancy; if Waiter is accidentally run in 
the future, the firewall rule will block access to its port. Uninstalling the 
program, as in option D, improves security by reducing the risk that the 
program will be accidentally run in the future. Most programs don’t have a 
“stealth” mode, so option B is incorrect. (Furthermore, reading the 
documentation isn’t enough; to improve security, you must change some 
configuration.) Tunneling Waiter’s connections might have some benefit in 
some situations, but this configuration requires setup on both client and 
server computers and by itself leaves the server’s port open, so option C is 
incorrect. Clients associated with the server program, installed on the server 
computer, pose little or no risk of abuse of the associated server; the clients 
on other computers are most likely to be used to abuse a server program, 
and you can’t control that. Thus option E is incorrect. 


11. B. Option B correctly describes how to accomplish this goal. Option A is 
incorrect because the hosts_allowed option isn’t a legal xinetd 
configuration file option. Option C correctly describes how to configure the 
described restriction using TCP wrappers, which is generally used with 
inetd, but it’s not the way this is done using xinetd. Option D is also a 
TCP wrappers description, but it reverses the meaning. Option E’s 
iptables utility configures a firewall. Although a firewall rule could be a 
useful redundant measure, the question specifies an xinetd configuration, 
and option E’s use of iptables is incorrect. 


12. B. Ideally, passwords should be completely random but still memorable. 
Option B’s password was generated from a personally meaningful acronym 
and then modified to change the case of some letters, add random numbers 
and symbols, and extend its length using a repeated character. This creates a 
password that’s close to random but still memorable. Option A uses a well- 
known mythological figure, who is likely to be in a dictionary. Option C 
uses two common words, which is arguably better than option A, but not by 
much. Option D uses two closely related words separated by a single 
number, which is also a poor choice for a password. Option E uses a 
sequential series of numbers, which is a poor (but sadly common) password 
choice. 


13. A. Phishing (option A) involves sending bogus email or setting up fake 


websites that lure unsuspecting individuals into divulging sensitive 
financial information or other sensitive information. Script kiddies (option 
B) are intruders who use root kits. Spoofing (option C) involves pretending 
that data is coming from one computer when it’s coming from another. 
Ensnaring (option D) isn’t a type of attack. Hacking (option E) refers to 
either lawful use of a computer for programming or other advanced tasks or 
breaking into computers. 


14. C. The etcnologin file, if present, prevents logins from ordinary users; 
only root may log in. You might set this file when performing maintenance 
and then forget to remove it, thus explaining the symptoms in the question. 
Thus, option C is correct. The syslogd daemon mentioned in option A 
records system messages, and it is unlikely to produce the specified 
symptoms. The login process ordinarily runs as root and is normally SUID 
root, so options B and D are also incorrect. Shadow passwords, as in 
option E, are used on almost all modern Linux systems and are not likely to 
cause these symptoms. 


15. B, C. SSH is most directly a replacement for Telnet (option B), but SSH 
also includes file-transfer features that enable it to replace FTP (option C) 
in many situations. SSH is not a direct replacement for the Simple Mail 
Transfer Protocol (SMTP, option A), the Network Time Protocol (NTP, 
option D), or Samba (option E). 


16. A . The ssh_host_dsa_key file holds one of three critical private keys for 
SSH. The fact that this key is readable (and writeable!) to the entire world 
is disturbing, so option A is correct. In principle, a troublemaker who has 
acquired this file might be able to redirect traffic and masquerade as your 
system, duping users into delivering passwords and other sensitive data. 
Because of this, option B (no) is an incorrect response, and the conditions 
imposed by options C, D, and E are all irrelevant, making all of these 
options incorrect. 


17. B. SSH protocol level 2 is more secure than protocol level 1; thus option B 
(specifying acceptance of level 2 only) is the safest approach. Option A is 
the least safe approach because it precludes the use of the safer level 2. 
Options C and D are exactly equivalent in practice; both support both 
protocol levels. Option E is invalid. 


18. E. Allowing only normal users to log in via SSH effectively requires two 
passwords for any remote root maintenance, improving security, so option 


E is correct. Whether or not you permit root logins, the SSH server must 
normally run as root, since SSH uses port 22, a privileged port. Thus, 
option A is incorrect. SSH encrypts all connections, so it’s unlikely that the 
password, or commands issued during an SSH session, will be intercepted, 
so option B isn’t a major concern. (Nonetheless, some administrators prefer 
not to take even this small risk.) SSH doesn’t store passwords in a file, so 
option C is incorrect. Because SSH employs encryption, option D is 
incorrect (this option better describes Telnet than SSH). 


19. D. Option D provides the correct command to import fredkey. pub prior to 
use. The inspect-gpg, import-gpg, and gpg-import commands of options 
A, CG, and E are fictitious, and there is no - -readkey option to gpg, as 
option B suggests. 


20. E. The usual method of sending encrypted messages with GPG entails the 
sender using the recipient’s public key to encrypt the message. Thus, option 
E is correct. Option A would be correct if your correspondent needed to 
send you an encrypted message, but the question only specifies you sending 
the encrypted message. Options B, C, and D all entail delivery of private 
keys, which is inadvisable at best, because private keys in the wrong hands 
permit the holder to impersonate the person who owns the keys. 
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